|
To end this tutorial, we propose you a visual comparison of the original C source code and our final interactively disassembled code.
来look look我们用IDA整理的结果把
struct customer_t {
long id;
char name[32];
char sex;
} |
; ------------------------------------------------------------- customer_t struc ; (sizeof=0x28) id dd ? namedb 32 dup(?) ; string(C) sexdd ? ; char customer_t ends
|
struct softwares_t {
long count;
software_t softs[];
}; |
; ------------------------------------------------------------- softwares_t struc ; (sizeof=0x4, variable size) count dd ? softs software_t 0 dup(?) softwares_t ends
|
struct book_t {
char title[128];
};
|
; ------------------------------------------------------------- book_t struc ; (sizeof=0x80) titledb 128 dup(?) ; string(C) book_t ends
|
struct software_t {
software_info_t info;
char name[32];
}; |
; ------------------------------------------------------------- software_t struc ; (sizeof=0x24) info dd ? ; enum software_info_t namedb 32 dup(?) ; string(C) software_t ends
|
union product_u {
book_t book;
software_t software;
}; |
; ------------------------------------------------------------- product_u union ; (sizeof=0x80) book book_t ? software software_t ? product_u ends
|
struct product_t {
long id;
product_category_t category;
product_u p;
};
|
; ------------------------------------------------------------- product_t struc ; (sizeof=0x88) id dd ? category dd ? ; enum product_category_t p product_u ? product_t ends
|
enum product_category_t {
BOOK,
SOFTWARE,
HARDWARE
};
|
; ------------------------------------------------------------- ; enum product_category_t BOOK = 0 SOFTWARE = 1 HARDWARE = 2
|
struct software_info_t {
unsigned int plateform : 2;
#define PC 0x1 // 0x01
#define MAC 0x2 // 0x02
unsigned int os : 3;
#define WINDOWS 0x1 // 0x04
#define DOS 0x2 // 0x08
#define OS_X 0x4 // 0x10
unsigned int category : 2;
#define DISASSEMBLY 0x1 // 0x20
#define RECOVERY 0x2 // 0x40
#define CRYPTOGRAPHY 0x3 // 0x60
}; |
; ------------------------------------------------------------- ; enum software_info_t (bitfield) PC = 1 MAC = 2 WINDOWS = 4 DOS = 8 OS_X = 10h category = 60h DISASSEMBLY = 20h RECOVERY = 40h CRYPTOGRAPHY = 60h
|
|
; +------------------------------------------------------------+ ; |This file is generated by The Interactive Disassembler (IDA)| ; |Copyright (c) 2003 by DataRescue sa/nv, <ida@datarescue.com>| ; | Licensed to: Eric <eric@datarescue.be>| ; +------------------------------------------------------------+ ; ; File Name : C:\IDA\Presentations\Data\data.exe ; Format : Portable executable for IBM PC (PE) ; Section 1. (virtual address 00001000) ; Virtual size : 00009000 ( 36864.) ; Section size in file : 00008E00 ( 36352.) ; Offset to raw data for section: 00000600 ; Flags 60000020: Text Executable Readable ; Alignment : 16 bytes ? unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm model flat ; -------------------------------------------------------------- ; Segment type: Pure code ; Segment permissions: Read/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h ; [COLLAPSED AREA .text1. PRESS KEYPAD "+" TO EXPAND]
|
int check_software(software_info_t
software_info)
{
bool valid = true;
if (software_info.plateform & PC)
{
if (! (software_info.plateform
& MAC)
&& (software_info.os & OS_X))
valid = false;
}
else if (software_info.plateform
& MAC)
{
if (! (software_info.plateform
& PC)
&& ((software_info.os
& WINDOWS)
|| (software_info.os
& DOS)))
valid = false;
}
else
valid = false;
return valid;
} |
; ||||||||||||||| S U B R O U T I N E |||||||||||||||||||||||||| ; Attributes: bp-based frame ; int __cdecl check_software(software_info_t software_info) check_software proc near ; CODE XREF: main+108p software_info= byte ptr 8 push ebp mov ebp, esp mov al, 1 mov dl, [ebp+software_info] and edx, PC or MAC test dl, PC jz short not_PC mov cl, [ebp+software_info] and ecx, PC or MAC test cl, MAC jnz short end mov dl, [ebp+software_info] shr edx, 2 and edx, (WINDOWS or DOS or OS_X) >> 2 test dl, OS_X >> 2 jz short end xor eax, eax jmp short end ; -------------------------------------------------------------- not_PC: ; CODE XREF: check_software+Ej mov cl, [ebp+software_info] and ecx, PC or MAC test cl, MAC jz short not_MAC mov dl, [ebp+software_info] and edx, PC or MAC test dl, PC jnz short end mov cl, [ebp+software_info] shr ecx, 2 and ecx, (WINDOWS or DOS or OS_X) >> 2 test cl, WINDOWS >> 2 jnz short not_windows mov dl, [ebp+software_info] shr edx, 2 and edx, (WINDOWS or DOS or OS_X) >> 2 test dl, DOS >> 2 jz short end not_windows: ; CODE XREF: check_software+4Fj xor eax, eax jmp short end ; -------------------------------------------------------------- not_MAC: ; CODE XREF: check_software+36j xor eax, eax end: ; CODE XREF: check_software+19j ... xor edx, edx mov dl, al mov eax, edx pop ebp retn check_software endp ; -------------------------------------------------------------- align 4
|
int check_product(product_category_t
product_category)
{
bool valid = true;
if (product_category == HARDWARE)
{
valid = false;
printf(“We don’t sell hardware
for the moment…\n”);
}
return valid;
} |
; ||||||||||||||| S U B R O U T I N E |||||||||||||||||||||||||| ; Attributes: bp-based frame ; int __cdecl check_product(product_category_t product_category) check_product proc near ; CODE XREF: print_product+Ap main+D8p product_category= dword ptr 8 push ebp mov ebp, esp push ebx mov bl, 1 cmp [ebp+product_category], HARDWARE jnz short not_hardware xor ebx, ebx push offset aWeDonTSellHardwareForThe ; format call _printf pop ecx not_hardware: ; CODE XREF: check_product+Aj xor eax, eax mov al, bl pop ebx pop ebp retn check_product endp
|
void print_customer(customer_t *customer)
{
printf(“CUSTOMER %04X: %s (%c)\n”,
customer->id, customer->name,
customer->sex);
} |
; ||||||||||||||| S U B R O U T I N E |||||||||||||||||||||||||| ; Attributes: bp-based frame ; void __cdecl print_customer(customer_t *customer) print_customer proc near ; CODE XREF: main+19p customer= dword ptr 8 push ebp mov ebp, esp mov eax, [ebp+customer] movsx edx, byte ptr [eax+customer_t.sex] push edx lea ecx, [eax+customer_t.name] push ecx push [eax+customer_t.id] push offset aCustomer04xSC ; format call _printf add esp, 10h pop ebp retn print_customer endp
|
void print_book(book_t *book)
{
printf(“BOOK: %s\n”, book->title);
} |
; ||||||||||||||| S U B R O U T I N E |||||||||||||||||||||||||| ; Attributes: bp-based frame ; void __cdecl print_book(book_t *book) print_book proc near ; CODE XREF: print_product+38p book= dword ptr 8 push ebp mov ebp, esp push [ebp+book] push offset aBookS ; format call _printf add esp, 8 pop ebp retn print_book endp ; ------------------------------------------------------------- align 4
|
void print_software(software_t
*software)
{
printf(“SOFTWARE: %s:”,
software->name);
if (software->info.plateform & PC)
printf(” PC”);
if (software->info.plateform & MAC)
printf(” MAC”);
printf(“;”);
if (software->info.os & WINDOWS)
printf(” WINDOWS”);
if (software->info.os & DOS)
printf(” DOS”);
if (software->info.os & OS_X)
printf(” OS-X”);
printf(“;”);
switch(software->info.category)
{
case DISASSEMBLY:
printf(” DISASSEMBLY”);
break;
case RECOVERY:
printf(” RECOVERY”);
break;
case CRYPTOGRAPHY:
printf(” CRYPTOGRAPHY”);
break;
}
printf(“\n”);
} |
; ||||||||||||||| S U B R O U T I N E ||||||||||||||||||||||||| ; Attributes: bp-based frame ; void __cdecl print_software(software_t *software) print_software proc near ; CODE XREF: print_product+44p software= dword ptr 8 push ebp mov ebp, esp push ebx push esi mov ebx, [ebp+software] mov esi, offset aWeDonTSellHardwareForThe lea eax, [ebx+software_t.name] push eax lea edx, (aSoftwareS - aWeDonTSellHardwareForThe)[esi] push edx ; format call _printf add esp, 8 mov cl, byte ptr [ebx+software_t.info] and ecx, PC or MAC test cl, PC jz short not_pc lea eax, (aPc - aWeDonTSellHardwareForThe)[esi] push eax ; format call _printf pop ecx not_pc: mov dl, byte ptr [ebx+software_t.info] and edx, PC or MAC test dl, MAC jz short not_mac lea ecx, (aMac - aWeDonTSellHardwareForThe)[esi] push ecx ; format call _printf pop ecx not_mac: lea eax, (asc_40A31B - aWeDonTSellHardwareForThe)[esi] push eax ; format call _printf pop ecx mov dl, byte ptr [ebx+software_t.info] shr edx, 2 and edx, (WINDOWS or DOS or OS_X) >> 2 test dl, WINDOWS >> 2 jz short not_windows lea ecx, (aWindows - aWeDonTSellHardwareForThe)[esi] push ecx ; format call _printf pop ecx not_windows: mov al, byte ptr [ebx+software_t.info] shr eax, 2 and eax, (WINDOWS or DOS or OS_X) >> 2 test al, DOS >> 2 jz short not_dos lea edx, (aDos - aWeDonTSellHardwareForThe)[esi] push edx ; format call _printf pop ecx not_dos: mov cl, byte ptr [ebx+software_t.info] shr ecx, 2 and ecx, (WINDOWS or DOS or OS_X) >> 2 test cl, OS_X >> 2 jz short not_os_x lea eax, (aOsX - aWeDonTSellHardwareForThe)[esi] push eax ; format call _printf pop ecx not_os_x: lea edx, (asc_40A331 - aWeDonTSellHardwareForThe)[esi] push edx ; format call _printf pop ecx mov cl, byte ptr [ebx+software_t.info] shr ecx, 5 and ecx, category >> 5 dec ecx jz short DISASSEMBLY dec ecx jz short RECOVERY dec ecx jz short CRYPTOGRAPHY jmp short end ; ------------------------------------------------------------ DISASSEMBLY: lea eax, (aDisassembly - aWeDonTSellHardwareForThe)[esi] push eax ; format call _printf pop ecx jmp short end ; ------------------------------------------------------------ RECOVERY: lea edx, (aRecovery - aWeDonTSellHardwareForThe)[esi] push edx ; format call _printf pop ecx jmp short end ; ------------------------------------------------------------ CRYPTOGRAPHY: lea ecx, (aCryptography - aWeDonTSellHardwareForThe)[esi] push ecx ; format call _printf pop ecx end: lea eax, (asc_40A358 - aWeDonTSellHardwareForThe)[esi] push eax ; format call _printf pop ecx pop esi pop ebx pop ebp retn print_software endp ; ------------------------------------------------------------ align 4
|
bool print_product(product_t *product)
{
if (! check_product(
product->category))
return false;
printf(“PRODUCT %04X: “,
product->id);
switch(product->category) {
case BOOK:
print_book(&product->p.book);
break;
case SOFTWARE:
print_software(
&product->p.software);
break;
}
return true;
} |
; ||||||||||||||| S U B R O U T I N E |||||||||||||||||||||||| ; Attributes: bp-based frame ; int __cdecl print_product(product_t *product) print_product proc near ; CODE XREF: main+128p product= dword ptr 8 push ebp mov ebp, esp push ebx mov ebx, [ebp+product] push [ebx+product_t.category] ; product_category call check_product pop ecx test eax, eax jnz short check_product_ok xor eax, eax pop ebx pop ebp retn ; ------------------------------------------------------------ check_product_ok: ; CODE XREF: print_product+12j push [ebx+product_t.id] push offset aProduct04x ; format call _printf add esp, 8 mov edx, [ebx+product_t.category] sub edx, 1 jb short case_book jz short case_software jmp short default ; ------------------------------------------------------------ case_book: ; CODE XREF: print_product+2Ej add ebx, product_t.p.book.title push ebx ; book call print_book pop ecx jmp short default ; ------------------------------------------------------------ case_software: ; CODE XREF: print_product+30j add ebx, product_t.p.software.info push ebx ; software call print_software pop ecx default: ; CODE XREF: print_product+32j ... mov al, 1 pop ebx pop ebp retn print_product endp ; ------------------------------------------------------------ align 4
|
| void main() {
printf(“CUSTOMERS:\n”);
customer_t *customer = customers;
while (customer->id != 0)
{
print_customer(customer);
customer++;
}
product_t *products = (product_t*)
malloc(PRODUCTS_COUNT
* sizeof(product_t));
products[0].id = 1;
products[0].category = BOOK;
products[0].p.book = ida_book;
products[1].id = 2;
products[1].category = SOFTWARE;
products[1].p.software =
softwares.softs[0];
products[2].id = 3;
products[2].category = SOFTWARE;
products[2].p.software =
softwares.softs[1];
products[3].id = 4;
products[3].category = SOFTWARE;
products[3].p.software =
softwares.softs[2];
printf(“\nPRODUCTS:\n”);
for (int i = 0;
i < PRODUCTS_COUNT; i++)
{
if (! check_product(
products[i].category))
{
printf(“Invalid product !!!\n”);
break;
}
if (products[i].category
== SOFTWARE)
{
if (! check_software(
products[i].p.software.info))
{
printf(“Invalid
software !!!\n”);
break;
}
}
print_product(&products[i]);
}
free(products);
} |
; ||||||||||||||| S U B R O U T I N E |||||||||||||||||||||||| ; Attributes: bp-based frame ; void __cdecl main() main proc near ; DATA XREF: .data:0040A0D0o push ebp mov ebp, esp push ebx push esi push edi push offset aCustomers ; format call _printf pop ecx mov ebx, offset customers jmp short loc_401376 ; ------------------------------------------------------------ loop_print_customer: ; CODE XREF: main+25j push ebx ; customer call print_customer pop ecx add ebx, 40 loc_401376: ; CODE XREF: main+16j cmp [ebx+customer_t.id], 0 jnz short loop_print_customer push 544 ; size call _malloc pop ecx mov ebx, eax mov [ebx+product_t.id], 1 xor eax, eax ; BOOK mov [ebx+product_t.category], eax mov esi, offset aIdaQuickstartG ; "IDA QuickStart Guide" lea edi, [ebx+product_t.p.book.title] mov ecx, 32 rep movsd mov dword ptr [ebx+product_t[1].id], 2 mov dword ptr [ebx+product_t[1].category], SOFTWARE mov esi, offset softwares.softs lea edi, [ebx+product_t[1].p.software] mov ecx, 9 rep movsd mov dword ptr [ebx+product_t[2].id], 3 mov dword ptr [ebx+product_t[2].category], SOFTWARE mov esi, (offset softwares.softs.info+24h) lea edi, [ebx+product_t[2].p.software] mov ecx, 9 rep movsd mov dword ptr [ebx+product_t[3].id], 4 mov dword ptr [ebx+product_t[3].category], SOFTWARE mov esi, (offset softwares.softs.info+48h) lea edi, [ebx+product_t[3].p.software] mov ecx, 9 rep movsd push offset aProducts ; format call _printf pop ecx xor esi, esi loop_verify_print_product: ; CODE XREF: main+132j mov eax, esi shl eax, 4 add eax, esi push [ebx+eax*8+product_t.category] ; product_category call check_product pop ecx test eax, eax jnz short product_is_valid push offset aInvalidProduct ; format call _printf pop ecx jmp short exit ; ------------------------------------------------------------ product_is_valid: ; CODE XREF: main+E0j mov edx, esi shl edx, 4 add edx, esi cmp [ebx+edx*8+product_t.category], SOFTWARE jnz short print_product mov ecx, esi shl ecx, 4 add ecx, esi push [ebx+ecx*8+product_t.p.software.info] ; software_info call check_software pop ecx test eax, eax jnz short print_product push offset aInvalidSoftwar ; format call _printf pop ecx jmp short exit ; ----------------------------------------------------------- print_product: ; CODE XREF: main+FBj main+110j imul eax, esi, 88h add eax, ebx push eax ; product call print_product pop ecx inc esi cmp esi, 4 jl short loop_verify_print_product exit: ; CODE XREF: main+EDj main+11Dj push ebx ; block call _free pop ecx pop edi pop esi pop ebx pop ebp retn main endp
|
|
; [COLLAPSED AREA .text2. PRESS KEYPAD "+" TO EXPAND] ; [COLLAPSED AREA .text2. PRESS KEYPAD "+" TO EXPAND] ; Section 2. (virtual address 0000A000) ; Virtual size : 00003000 ( 12288.) ; Section size in file : 00002800 ( 10240.) ; Offset to raw data for section: 00009400 ; Flags C0000040: Data Readable Writable ; Alignment : 16 bytes ? ; ------------------------------------------------------------ ; Segment type: Pure data ; Segment permissions: Read/Write _data segment para public 'DATA' use32 assume cs:_data ;org 40A000h ; [COLLAPSED AREA .data1. PRESS KEYPAD "+" TO EXPAND]
|
customer_t customers[] = {
{ 1,
"Peter",
'm' },
{ 2,
"John",
'm' },
{ 3,
"Mary",
'f' },
{ 0 }
}; |
customers dd 1 ; id ; DATA XREF: main+11o db 'Peter',0,0,0,0,0,0,0,0,0,0,0,0,0,0, ... ; name dd 'm' ; sex dd 2 ; id db 'John',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,... ; name dd 'm' ; sex dd 3 ; id db 'Mary',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,... ; name dd 'f' ; sex dd 0 ; id db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, ... ; name db 0 ; name dd 0 ; sex
|
book_t ida_book = { "IDA QuickStart
Guide" }; |
aIdaQuickstartG db 'IDA QuickStart Guide',0 ; DATA XREF: ... db 6Bh dup(0)
|
softwares_t softwares =
{
3,
{ { { PC, WINDOWS|DOS,
DISASSEMBLY },
"IDA Pro" },
{ { PC|MAC, WINDOWS|OS_X,
RECOVERY },
"PhotoRescue" },
{ { PC, WINDOWS,
CRYPTOGRAPHY },
"aCrypt" }
}
}; |
softwares dd 3 ; count ; DATA XREF: main+62o dd PC or WINDOWS or DOS or DISASSEMBLY; softs.info db 'IDA Pro',0,0,0,0,0,0,0,0,0,0,0,0,0, ...; softs.name dd PC or MAC or WINDOWS or OS_X or RECOVERY; softs.info db 'PhotoRescue',0,0,0,0,0,0,0,0,0,0,0, ...; softs.name dd PC or WINDOWS or CRYPTOGRAPHY; softs.info db 'aCrypt',0,0,0,0,0,0,0,0,0,0,0,0,0,0,...; softs.name
|
|
aWeDonTSellHardwareForThe db 'We don',27h,'t sell hardware ... ; DATA XREF: check_product+Eo ... aCustomer04xSC db 'CUSTOMER %04X: %s (%c)',0Ah,0 ; ... aBookS db 'BOOK: %s',0Ah,0 ; DATA XREF: print_book+6o aSoftwareS db 'SOFTWARE: %s:',0 ; DATA XREF: ... aPc db ' PC',0 ; DATA XREF: print_software+27r aMac db ' MAC',0 ; DATA XREF: print_software+3Br asc_40A31B db ';',0 ; DATA XREF: print_software+45r aWindows db ' WINDOWS',0 ; DATA XREF: ... aDos db ' DOS',0 ; DATA XREF: print_software+72r aOsX db ' OS-X',0 ; DATA XREF: print_software+89r asc_40A331 db ';',0 ; DATA XREF: print_software+93r aDisassembly db ' DISASSEMBLY',0 ; DATA XREF: ...
aRecovery db ' RECOVERY',0 ; DATA XREF: ... aCryptography db ' CRYPTOGRAPHY',0 ; DATA XREF: ... asc_40A358 db 0Ah,0 ; DATA XREF: print_software+D8r aProduct04x db 'PRODUCT %04X: ',0 ; DATA XREF: ... aCustomers db 'CUSTOMERS:',0Ah,0 ; DATA XREF: ... aProducts db 0Ah ; DATA XREF: main+C0o db 'PRODUCTS:',0Ah,0 aInvalidProduct db 'Invalid product !!!',0Ah,0 ; ... aInvalidSoftwar db 'Invalid software !!!',0Ah,0 ; ...
|
|
2 条评论
图统统看不见了
已更正，谢谢。