零基础逆向工程14_C语言08_指针02_反汇编

1.指针数组

5:        char* keyword[] = {"if", "for", "while", "switch"};  //数组指针，大小为4×4=16字节
0040D7D8   mov         dword ptr [ebp-10h],offset string "AAA" (00422028)
0040D7DF   mov         dword ptr [ebp-0Ch],offset string "for" (00422024)
0040D7E6   mov         dword ptr [ebp-8],offset string "DDD" (0042201c)
0040D7ED   mov         dword ptr [ebp-4],offset string "\xb5\xd8\xd6\xb7\xce\xaa%x, \xca\xc7\xb5\xda%d\xb8\xf6\

2.数组和指针

*(p+i) = p[i]
*(*(p+i)+k) = p[i][k]
*(*(*(p+i)+k)+m) = p[i][k][m]

一段反汇编代码分析

5:        int x = 100;
00401028   mov         dword ptr [ebp-4],64h
6:        int* p = &x;
0040102F   lea         eax,[ebp-4]
00401032   mov         dword ptr [ebp-8],eax
7:        int** p1 = &p;
00401035   lea         ecx,[ebp-8]
00401038   mov         dword ptr [ebp-0Ch],ecx
8:
9:        printf("%d\n", x);
0040103B   mov         edx,dword ptr [ebp-4]
0040103E   push        edx
0040103F   push        offset string "%d\n" (0042201c)
00401044   call        printf (004010e0)
00401049   add         esp,8
10:       printf("%d\n", *p);
0040104C   mov         eax,dword ptr [ebp-8]
0040104F   mov         ecx,dword ptr [eax]
00401051   push        ecx
00401052   push        offset string "%d\n" (0042201c)
00401057   call        printf (004010e0)
0040105C   add         esp,8
11:       printf("%d\n", **p1);
0040105F   mov         edx,dword ptr [ebp-0Ch]
00401062   mov         eax,dword ptr [edx]
00401064   mov         ecx,dword ptr [eax]
00401066   push        ecx
00401067   push        offset string "%d\n" (0042201c)
0040106C   call        printf (004010e0)
00401071   add         esp,8
12:       printf("%d\n", p[0]);
00401074   mov         edx,dword ptr [ebp-8]
00401077   mov         eax,dword ptr [edx]
00401079   push        eax
0040107A   push        offset string "%d\n" (0042201c)
0040107F   call        printf (004010e0)
00401084   add         esp,8
13:       printf("%d\n", p1[0][0]);
00401087   mov         ecx,dword ptr [ebp-0Ch]
0040108A   mov         edx,dword ptr [ecx]
0040108C   mov         eax,dword ptr [edx]
0040108E   push        eax
0040108F   push        offset string "%d\n" (0042201c)
00401094   call        printf (004010e0)
00401099   add         esp,8

3.数组指针

一段反汇编代码分析

#include <stdio.h>

char code[]=
{
	0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,
	0x0b,0x0c,0x0d,0x0e,0x0f,0x10,0x11,0x12,0x13,0x14,
	0x15,0x16,0x17,0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,
	0x1f,0x20,0x21,0x22,0x23,0x24,0x25,0x26,0x27,0x28,
	0x29,0x2a,0x2b,0x2c,0x2d,0x2e,0x2f,0x30,0x31,0x32,
	0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3a,0x3b,0x3c,
	0x3d,0x3e,0x3f,0x40,0x41,0x42,0x43,0x44,0x45,0x46,
	0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,0x4e,0x4f,0x50,
	0x51,0x52,0x53,0x54,0x55,0x56,0x57,0x58,0x59,0x5a,
	0x5b,0x5c,0x5d,0x5e,0x5f,0x60,0x61,0x62,0x63,0x64
};

int main()
{
	//1.一维数组指针
	//int (*px)[5];
	//px = (int (*)[5]code);
	//printf("%x\n", *(*(px+2)+2));
	//2.二维数组指针
	char (*py)[2][3];
	py = (char (*)[2][3])code;         //2*3*1 = 6   // 3*1 = 3
	printf("%x\n", *(*(*(py+2)+3)+4));  // 12+9+4 = 25  即结果为0x1a
	//3.三维数组指针
	return 0;
}

4.函数指针

函数的反汇编代码

int Function(int x, int y)
{
	return x+y;
}

00401010 55                   push        ebp
00401011 8B EC                mov         ebp,esp
00401013 83 EC 40             sub         esp,40h
00401016 53                   push        ebx
00401017 56                   push        esi
00401018 57                   push        edi
00401019 8D 7D C0             lea         edi,[ebp-40h]
0040101C B9 10 00 00 00       mov         ecx,10h
00401021 B8 CC CC CC CC       mov         eax,0CCCCCCCCh
00401026 F3 AB                rep stos    dword ptr [edi]
00401028 8B 45 08             mov         eax,dword ptr [ebp+8]
0040102B 03 45 0C             add         eax,dword ptr [ebp+0Ch]
0040102E 5F                   pop         edi
0040102F 5E                   pop         esi
00401030 5B                   pop         ebx
00401031 8B E5                mov         esp,ebp
00401033 5D                   pop         ebp
00401034 C3                   ret

取其硬编码，写函数调用

#include <stdio.h>

int x = 10;
unsigned char arr[] =
{
	0x55,
	0x8B, 0xEC,
	0x83, 0xEC, 0x40,
	0x53,
	0x56,
	0x57,
	0x8D, 0x7D, 0xC0,
	0xB9, 0x10, 0x00, 0x00, 0x00,
	0xB8, 0xCC, 0xCC, 0xCC, 0xCC,
	0xF3, 0xAB,
	0x8B, 0x45, 0x08,
	0x03, 0x45, 0x0C,
	0x5F,
	0x5E,
	0x5B,
	0x8B, 0xE5,
	0x5D,
	0xC3
};

int main()
{
	int (*pFun)(int, int);

	pFun = (int (*)(int ,int ))arr;

	x = pFun(2, 3);

	printf("%d\n", x);

	return 0;
}

补充：指针的本质

1.是一个类型

2.宽度是四

3.可以作加减的运算

4.可以与整数相加相减

5.可以比较大小