当前位置：首页 > news >正文

x32dbg/x64dbg逆向之反汇编while分析

news 2026/8/16 2:27:15

x32dbg/x64dbg逆向之反汇编while分析
1）反汇编while分析
while咱们也经常用到在开发中，经常会遇到遍历处理数组，或是某段逻辑需要反复执行，仅少量参数存在差异的场景，这时就会选用while语句来实现循环逻辑。编译后映射到汇编代码里具体是什么样子，咱们一步步调试看下哦！

3）C语言案例代码，单个while
咱们在学习逆向分析的同时，同步梳理C和C++基础知识点，一正一反（正向开发，逆向分析）为后续深耕底层技术打好基础哦。
#include <stdio.h>
int main()
{
int i = 1;
// Single while loop and print numbers 1 to 5
while(i <= 5)
{
printf("%d ", i);
i++;
}
return 0;
}

4）C语言案例代码，多个while
咱们在学习逆向分析的同时，同步梳理C和C++基础知识点，一正一反（正向开发，逆向分析）为后续深耕底层技术打好基础哦。
#include <stdio.h>

int main()
{
int x = 1;

while (x <= 5)
{
printf("%d ", x);
x++;
}

printf("\n");
printf("\n");
x = 0;

// First while loop
while (x <= 2)
{
int y = 1;
printf("| ");
// Second middle while loop
while (y <= 2)
{
int z = 1;
// Third innermost while loop
while (z <= 3)
{
printf("* ");
z++;
}
printf("| ");
y++;
}
printf("\n");
x++;
}
return 0;
}

5）反向分析指针单个while
x64Debug版本
00007FF780261840 | 40:55 | push rbp | FileName.cpp:3
00007FF780261842 | 57 | push rdi |
00007FF780261843 | 48:81EC 08010000 | sub rsp,108 | 开辟空间
00007FF78026184A | 48:8D6C24 20 | lea rbp,qword ptr ss:[rsp+20] |
00007FF78026184F | 48:8D0D B2F70000 | lea rcx,qword ptr ds:[<__14F49BB1_FileN | FileName.cpp:15732480
00007FF780261856 | E8 3DFBFFFF | call project1.7FF780261398 |
00007FF78026185B | 90 | nop |
00007FF78026185C | C745 04 01000000 | mov dword ptr ss:[rbp+4],1 | FileName.cpp:4，局部变量赋值，x = 1
00007FF780261863 | 837D 04 05 | cmp dword ptr ss:[rbp+4],5 | FileName.cpp:6，对比局部变量是否大于5，while (x <= 5)跳出循环。
00007FF780261867 | 7F 1A | jg project1.7FF780261883 | 如果大于跳出
00007FF780261869 | 8B55 04 | mov edx,dword ptr ss:[rbp+4] | FileName.cpp:8，打印的第二个参数
00007FF78026186C | 48:8D0D B1830000 | lea rcx,qword ptr ds:[<"%d "...>] | 00007FF780269C24:"%d "，打印的第一个字符串格式化参数
00007FF780261873 | E8 D1F9FFFF | call project1.7FF780261249 | printf
00007FF780261878 | 90 | nop |
00007FF780261879 | 8B45 04 | mov eax,dword ptr ss:[rbp+4] | FileName.cpp:9
00007FF78026187C | FFC0 | inc eax | i++，局部变量++
00007FF78026187E | 8945 04 | mov dword ptr ss:[rbp+4],eax |
00007FF780261881 | EB E0 | jmp project1.7FF780261863 | FileName.cpp:10，继续循环下一次对比
00007FF780261883 | 33C0 | xor eax,eax | FileName.cpp:11，main准备返回
00007FF780261885 | 48:8DA5 E8000000 | lea rsp,qword ptr ss:[rbp+E8] | FileName.cpp:12
00007FF78026188C | 5F | pop rdi |
00007FF78026188D | 5D | pop rbp |
00007FF78026188E | C3 | ret |

x86Debug版本
002D1840 | 55 | push ebp | FileName.cpp:3
002D1841 | 8BEC | mov ebp,esp |
002D1843 | 81EC CC000000 | sub esp,CC |
002D1849 | 53 | push ebx |
002D184A | 56 | push esi | esi:"閗\r"
002D184B | 57 | push edi | edi:"閗\r"
002D184C | 8D7D F4 | lea edi,dword ptr ss:[ebp-C] | [ebp-0C]:BaseThreadInitThunk+19
002D184F | B9 03000000 | mov ecx,3 | ecx:"閗\r"
002D1854 | B8 CCCCCCCC | mov eax,CCCCCCCC |
002D1859 | F3:AB | rep stosd |
002D185B | B9 08C02D00 | mov ecx,<project1._14F49BB1_FileName@cp | FileName.cpp:15732480, ecx:"閗\r"
002D1860 | E8 B1FAFFFF | call project1.2D1316 |
002D1865 | 90 | nop | 上面全部是x86专有的

查看全文

http://www.jsqmd.com/news/1401868/