Àóäèò è äèçàññåìáëèðîâàíèå exploit'îâ



ìîòàåì öèêë


seg000:0000004A EB F4             jmp    short loc_40  ; ìîòàåì öèêë




seg000:0000004C

seg000:0000004C loc_4C:                         ; CODE XREF: seg000:00000043^j

seg000: 0000004C 3B 54 24 28 cmp    edx, [esp+28h]       ; ýòî "íàø" õýø?

seg000:00000050 75 E5             jnz    short loc_37  ; ïðîäîëæàåì ïîèñê åñëè íå íàø

seg000:00000052 8B 5F 24   mov    ebx, [edi+24h]       ; ordinalTableRVA

seg000:00000055 01 EB             add    ebx, ebp      ; ordinalTable VA

seg000:00000057 66 8B 0C 4B mov    cx, [ebx+ecx*2]; index

seg000:0000005B 8B 5F 1C   mov    ebx, [edi+1Ch]       ; exportAddressTableRVA

seg000:0000005E 01 EB             add    ebx, ebp      ; exportAddressTable VA

seg000:00000060 03 2C 8B   add    ebp,[ebx+ecx*4]; âîò îíà íàøà ôóíêöèÿ!!!

seg000:00000063 89 6C 24 1C mov    [esp+1Ch], ebp

; ñîõðàíÿåì â EAX

seg000:00000067 61         popa                 ; âîññòàíàâëèâàåì ðåãèñòðû

seg000:00000068 C3         retn                 ; âîçâðàùàåìñÿ èç ôóíêöèè


Ñîäåðæàíèå ðàçäåëà