The Art of Reversing by Ap0x - Tutoriali.org

77F79B4D /$ BA DF9BF777 MOV EDX,ntdll.77F79BDF
77F79B52 |. 8D09
LEA ECX,DWORD PTR DS:[ECX]
77F79B54 |> 53
PUSH EBX
77F79B55 |. 56
PUSH ESI
77F79B56 |. 57
PUSH EDI
77F79B57 |. 33C0
XOR EAX,EAX
77F79B59 |. 33DB
XOR EBX,EBX
77F79B5B |. 33F6
XOR ESI,ESI
77F79B5D |. 33FF
XOR EDI,EDI
77F79B5F |. FF7424 20 PUSH DWORD PTR SS:[ESP+20] ; /Arg5
77F79B63 |. FF7424 20 PUSH DWORD PTR SS:[ESP+20] ; |Arg4
77F79B67 |. FF7424 20 PUSH DWORD PTR SS:[ESP+20] ; |Arg3
77F79B6B |. FF7424 20 PUSH DWORD PTR SS:[ESP+20] ; |Arg2
77F79B6F |. FF7424 20 PUSH DWORD PTR SS:[ESP+20] ; |Arg1
77F79B73 |. E8 06000000 CALL ntdll.77F79B7E ; \ntdll.77F79B7E
77F79B78 |. 5F
POP EDI
77F79B79 |. 5E
POP ESI
77F79B7A |. 5B
POP EBX
77F79B7B \. C2 1400 RET 14
....
77F79BA2 |. FFD1
CALL ECX
77F79BA4 |. 64:8B25 00000> MOV ESP,DWORD PTR FS:[0]
77F79BAB |. 64:8F05 00000> POP DWORD PTR FS:[0]
77F79BB2 |. 8BE5
MOV ESP,EBP
77F79BB4 |. 5D
POP EBP
77F79BB5 \. C2 1400 RET 14
Sada cemo se kretati sa F8 preko svih ostalih ASM komandi sem CALLova u
koje cemo ulaziti sa F7. Zadnji CALL u koji cemo ovde uci je CALL ECX posle
cega stizemo ovde:
00882FBE 8B6424 08 MOV ESP,DWORD PTR SS:[ESP+8]
00882FC2 EB 0C JMP SHORT 00882FD0
00882FC4 2BD2 SUB EDX,EDX
00882FC6 64:FF32 PUSH DWORD PTR FS:[EDX]
ovde se ne desava nista bitno po otpakivanje pa cemo sa F8 ici kroz kod sve
dok ne dodjemo do skoka koji bi nas vratio daleko gore u kod. Taj skok se
nalazi ovde:
0088307D /E3 03 JECXZ SHORT 00883082
0088307F |59
POP ECX
00883080 ^|EB C8 JMP SHORT 0088304A