| 网站首页 | 业界新闻 | 小组 | 威客 | 人才 | 下载频道 | 博客 | 代码贴 | 在线编程 | 编程论坛
欢迎加入我们,一同切磋技术
用户名:   
 
密 码:  
共有 1195 人关注过本帖
标题:这个是汇编写的吗?
只看楼主 加入收藏
xjyangjm
Rank: 1
等 级:新手上路
帖 子:4
专家分:0
注 册:2012-1-7
结帖率:100%
收藏
已结贴  问题点数:20 回复次数:13 
这个是汇编写的吗?
::010AC000::  ED                       IN EAX,DX                              
::010AC001::  BA 32FAF2AD              MOV EDX,ADF2FA32                        
::010AC006::  D04A 32                  ROR BYTE PTR [EDX+32],1                 
::010AC009::  06                       PUSH ES                                 
::010AC00A::  37                       AAA                                    
::010AC00B::  78 ED                    JS SHORT 010ABFFA                       \:JMPUP
::010AC00D::  B7 44                    MOV BH,44                              
::010AC00F::  24 92                    AND AL,92                              
::010AC011::  42                       INC EDX                                 
::010AC012::  25 3452E327              AND EAX,27E35234                        
::010AC017::  7F EB                    JG SHORT 010AC004                       \:JMPUP
::010AC019::  B4 4F                    MOV AH,4F                               \:BYJMP JmpBy:010AC054,
::010AC01B::  89B4FE F2202741          MOV [ESI+EDI*8+412720F2],ESI            
::010AC022::  B2 00                    MOV DL,0                                
::010AC024::  8C9C90 D97EA2FA          MOV [EAX+EDX*4+FAA27ED9],DS            
::010AC02B::  4F                       DEC EDI                                 
::010AC02C::  5E                       POP ESI                                 
::010AC02D::  D109                     ROR DWORD PTR [ECX],1                  
::010AC02F::  D6                       SALC                                    
::010AC030::  032451                   ADD ESP,[ECX+EDX*2]                     
::010AC033::  7B 2C                    JPO SHORT 010AC061                      \:JMPDOWN
::010AC035::  82F9 02                  CMP CL,2                                
::010AC038::  8300 00                  ADD DWORD PTR [EAX],0                   \:BYJMP JmpBy:010AC09D,
::010AC03B::  F5                       CMC                                    
::010AC03C::  3F                       AAS                                    
::010AC03D::  3ADC                     CMP BL,AH                              
::010AC03F::  6F                       OUTS DX,DWORD PTR ES:[EDI]              
::010AC040::  AF                       SCAS DWORD PTR ES:[EDI]                 
::010AC041::  39E3                     CMP EBX,ESP                             
::010AC043::  D939                     FSTCW [ECX]                             
::010AC045::  9D                       POPFD                                   
::010AC046::  25 DC9C16A8              AND EAX,A8169CDC                        
::010AC04B::  35 7C5B2C40              XOR EAX,402C5B7C                        
::010AC050::  8E20                     MOV FS,[EAX]                           
::010AC052::  E5 5A                    IN EAX,5A                              
::010AC054::  E1 C3                    LOOPDE SHORT 010AC019                   \:JMPUP
::010AC056::  E0 6C                    LOOPDNE SHORT 010AC0C4                  \:JMPDOWN
::010AC058::  1BB8 F14BBADB            SBB EDI,[EAX+DBBA4BF1]                  
::010AC05E::  59                       POP ECX                                 
::010AC05F::  B9 923B9F31              MOV ECX,319F3B92                        
::010AC064::  2C 0A                    SUB AL,A                                
::010AC066::  2C CA                    SUB AL,CA                              
::010AC068::  BC B4B9E3D0              MOV ESP,D0E3B9B4                        
::010AC06D::  57                       PUSH EDI                                
::010AC06E::  96                       XCHG EAX,ESI                           
::010AC06F::  59                       POP ECX                                 
::010AC070::  E9 1F557DAB              JMP AC881594                            \:JMPDOWN
::010AC075::  337415 4E                XOR ESI,[EBP+EDX+4E]                    
::010AC079::  41                       INC ECX                                 
::010AC07A::  F4                       HLT                                    
::010AC07B::  0975 D4                  OR [EBP-2C],ESI                        
::010AC07E::  1098 AF047634            ADC [EAX+347604AF],BL                  
::010AC084::  2A20                     SUB AH,[EAX]                           
::010AC086::  B8 5E6471D9              MOV EAX,D971645E                        
::010AC08B::  19F3                     SBB EBX,ESI                             
::010AC08D::  2B27                     SUB ESP,[EDI]                           
::010AC08F::  DC9D 31CC155B            FCOMP QWORD PTR [EBP+5B15CC31]         
::010AC095::  40                       INC EAX                                 
::010AC096::  C19B 08A111B0 D4         RCR DWORD PTR [EBX+B011A108],D4         
::010AC09D::  7E 99                    JLE SHORT 010AC038                      \:JMPUP
::010AC09F::  68 B973AD95              PUSH 95AD73B9                           
::010AC0A4::  8C01                     MOV [ECX],ES                           
::010AC0A6::  4E                       DEC ESI                                 
::010AC0A7::  95                       XCHG EAX,EBP                           
::010AC0A8::  6A E7                    PUSH -19                                
::010AC0AA::  E9 9A94A2B3              JMP B4AD5549                            \:JMPDOWN
::010AC0AF::  49                       DEC ECX                                 
::010AC0B0::  07                       POP ES                                 
::010AC0B1::  8828                     MOV [EAX],CH                           
::010AC0B3::  D5 54                    AAD 54                                 
::010AC0B5::  3E:47                    INC EDI                                 
::010AC0B7::  DD                       ???                                    
::010AC0B8::  8E8481 C5519581          MOV ES,[ECX+EAX*4+819551C5]            
::010AC0BF::  4B                       DEC EBX                                 
::010AC0C0::  388F 398A42B2            CMP [EDI+B2428A39],CL                  
::010AC0C6::  E9 B3FC54FD              JMP FE5FBD7E                            \:JMPDOWN
::010AC0CB::  2D 78E900E4              SUB EAX,E400E978                        
::010AC0D0::  59                       POP ECX                                 
::010AC0D1::  7B F9                    JPO SHORT 010AC0CC                      \:JMPUP
::010AC0D3::  F5                       CMC                                    
::010AC0D4::  8F                       ???                                    
::010AC0D5::  64:FA                    CLI                                    
::010AC0D7::  0075 3B                  ADD [EBP+3B],DH                        
::010AC0DA::  B4 D0                    MOV AH,D0                              
::010AC0DC::  78 39                    JS SHORT 010AC117                       \:JMPDOWN
::010AC0DE::  49                       DEC ECX                                 
::010AC0DF::  27                       DAA                                    
::010AC0E0::  8780 C8CCCD1B            XCHG [EAX+1BCDCCC8],EAX                 
::010AC0E6::  F63E                     IDIV BYTE PTR [ESI]                     
::010AC0E8::  9A 9A5F9D73 93C9         CALL FAR C993:739D5F9A                  \:JMPDOWN
::010AC0EF::  B4 98                    MOV AH,98                              
::010AC0F1::  8585 3197CC42            TEST [EBP+42CC9731],EAX                 
::010AC0F7::  6C                       INS BYTE PTR ES:[EDI],DX               
::010AC0F8::  A7                       CMPS DWORD PTR [ESI],DWORD PTR ES:[EDI]
::010AC0F9::  B9 4C6054E0              MOV ECX,E054604C                        
::010AC0FE::  B0 6C                    MOV AL,6C                              
::010AC100::  F7D3                     NOT EBX                                 
::010AC102::  55                       PUSH EBP                                
::010AC103::  FD                       STD                                    
::010AC104::  8D48 82                  LEA ECX,[EAX-7E]                        
::010AC107::  D8AB C3294D7A            FSUBR DWORD PTR [EBX+7A4D29C3]         
::010AC10D::  CE                       INTO                                    
::010AC10E::  0F2B                     ???                                    
::010AC110::  99                       CDQ                                    
::010AC111::  49                       DEC ECX                                 
::010AC112::  D9AE C212F82F            FLDCW [ESI+2FF812C2]                    
::010AC118::  CB                       RETF                                    
::010AC119::  7D 3C                    JGE SHORT 010AC157                      \:JMPDOWN\:BYJMP JmpBy:010AC139,
::010AC11B::  C2 2F56                  RETN 562F                              
::010AC11E::  F732                     DIV DWORD PTR [EDX]                     
::010AC120::  AA                       STOS BYTE PTR ES:[EDI]                  
::010AC121::  BF 18EFE203              MOV EDI,3E2EF18                        
::010AC126::  61                       POPAD                                   
::010AC127::  8098 06B3762E 93         SBB BYTE PTR [EAX+2E76B306],93         
::010AC12E::  2F                       DAS                                    
::010AC12F::  38B0 669AABEE            CMP [EAX+EEAB9A66],DH                  
::010AC135::  312E                     XOR [ESI],EBP                           
::010AC137::  3C B8                    CMP AL,B8                              
::010AC139::  74 DE                    JE SHORT 010AC119                       \:JMPUP
::010AC13B::  F1                       ???                                    
::010AC13C::  94                       XCHG EAX,ESP                           
::010AC13D::  75 4A                    JNZ SHORT 010AC189                      \:JMPDOWN
::010AC13F::  68 FA8B0102              PUSH 2018BFA                           
::010AC144::  02A7 14B4CEC0            ADD AH,[EDI+C0CEB414]                   \:BYJMP JmpBy:010AC169,
::010AC14A::  CD 6A                    INT 6A                                 
::010AC14C::  0FB73D 3CF6B1CC          MOVZX EDI,WORD PTR [CCB1F63C]           
::010AC153::  F8                       CLC                                    
::010AC154::  A8 76                    TEST AL,76                              
::010AC156::  3912                     CMP [EDX],EDX                           
::010AC158::  99                       CDQ                                    
::010AC159::  46                       INC ESI                                 \:BYJMP JmpBy:010AC15E,
::010AC15A::  E3 8E                    JECXZ SHORT 010AC0EA                    \:JMPUP
::010AC15C::  67:60                    PUSHAD                                 
::010AC15E::  7D F9                    JGE SHORT 010AC159                      \:JMPUP
::010AC160::  6360 E6                  ARPL [EAX-1A],ESP                       
::010AC163::  E0 61                    LOOPDNE SHORT 010AC1C6                  \:JMPDOWN
::010AC165::  67:E0 E2                 LOOPNE SHORT 010AC14A                   \:JMPUP
::010AC168::  F8                       CLC                                    
::010AC169::  E1 D9                    LOOPDE SHORT 010AC144                   \:JMPUP
::010AC16B::  BC 0C4EEC7A              MOV ESP,7AEC4E0C                        
::010AC170::  5B                       POP EBX                                 
::010AC171::  58                       POP EAX                                 
::010AC172::  5F                       POP EDI                                 
::010AC173::  60                       PUSHAD                                 
::010AC174::  C5E5                     LDS ESP,EBP                             
::010AC176::  66:4B                    DEC BX                                 
::010AC178::  D7                       XLAT BYTE PTR [EBX+AL]                  
::010AC179::  52                       PUSH EDX                                
::010AC17A::  4F                       DEC EDI                                 
::010AC17B::  50                       PUSH EAX                                
::010AC17C::  52                       PUSH EDX                                
全的在附件里
123.rar (329.35 KB)


[ 本帖最后由 xjyangjm 于 2012-1-7 23:51 编辑 ]
2012-01-07 23:48
zaixuexi
Rank: 12Rank: 12Rank: 12
来 自:上海
等 级:火箭侠
威 望:8
帖 子:858
专家分:3233
注 册:2010-12-1
收藏
得分:7 
可能是,可能不是,按照我的理解,应该不像人写的,编译器生成的

技术问题,请不要以短消息方式提问
2012-01-08 11:29
xjyangjm
Rank: 1
等 级:新手上路
帖 子:4
专家分:0
注 册:2012-1-7
收藏
得分:0 
zaixuexi版主 怎么才能看出*.exe的文件是用什么语言写的呢。看这个代码能看出原程序是用汇编写的吗?
2012-01-08 18:01
zaixuexi
Rank: 12Rank: 12Rank: 12
来 自:上海
等 级:火箭侠
威 望:8
帖 子:858
专家分:3233
注 册:2010-12-1
收藏
得分:0 
特征码是由链接器来填充的,我也不知道呀

技术问题,请不要以短消息方式提问
2012-01-08 18:16
zaixuexi
Rank: 12Rank: 12Rank: 12
来 自:上海
等 级:火箭侠
威 望:8
帖 子:858
专家分:3233
注 册:2010-12-1
收藏
得分:0 
等z版来解答

技术问题,请不要以短消息方式提问
2012-01-08 18:17
zklhp
Rank: 20Rank: 20Rank: 20Rank: 20Rank: 20
来 自:china
等 级:贵宾
威 望:254
帖 子:11485
专家分:33241
注 册:2007-7-10
收藏
得分:7 
你发文件来看看呗

我咋感觉像是处理过的代码的 加壳或者是花指令或者是神马虚拟机。。
2012-01-08 21:21
zklhp
Rank: 20Rank: 20Rank: 20Rank: 20Rank: 20
来 自:china
等 级:贵宾
威 望:254
帖 子:11485
专家分:33241
注 册:2007-7-10
收藏
得分:0 
严格来讲 无法准确判断一个东西是什么语言写的

我知道的判断方法有两个 或者说是一个 就是风格。。

比如 VC debug版生成的代码里面 会初始化堆栈为CC 也就是int 3 如果看到一个程序有类似的代码 可以初步判断是VC编译的

或者 根据链接器的信息推断 貌似在PE文件的信息里面有类似的东东罢

可以看出 上面的两个都不是百分之百准确 比如我就用汇编模拟VC生成代码的风格写一个 连接器也看不出来 就会被认为是VC写的

所以 判断一个程序是什么语言写的没有可靠的方法 而且是无意义的

有个软件可以做到 PEID 可以去看雪下载全插件版 它根据的是特征码 也就是编译器连接器生成的某些固定的代码 你不发文件自己用这个程序看看也可以 呵呵
2012-01-08 21:28
zaixuexi
Rank: 12Rank: 12Rank: 12
来 自:上海
等 级:火箭侠
威 望:8
帖 子:858
专家分:3233
注 册:2010-12-1
收藏
得分:0 
z版v5

技术问题,请不要以短消息方式提问
2012-01-09 10:11
naruto01
Rank: 4
等 级:业余侠客
帖 子:103
专家分:280
注 册:2011-5-23
收藏
得分:7 
搜索pediy
2012-01-09 12:10
xjyangjm
Rank: 1
等 级:新手上路
帖 子:4
专家分:0
注 册:2012-1-7
收藏
得分:0 
我看那个TXT文件中有很多::010AC10E::  0F2B                     ???       这样的句子,不明白这个???是什么意思,等下我问朋友要下原文件。看看是干什么用的。                              
2012-01-09 13:19
快速回复:这个是汇编写的吗?
数据加载中...
 
   



关于我们 | 广告合作 | 编程中国 | 清除Cookies | TOP | 手机版

编程中国 版权所有,并保留所有权利。
Powered by Discuz, Processed in 0.033174 second(s), 10 queries.
Copyright©2004-2024, BCCN.NET, All Rights Reserved