汇编求助

ZJL520

  

子程序名	返回值类型	公开	备 注
AAA	整数型
参数名	类 型	参考	可空	数组	备 注
data	字节集
key	长整数型
DD	字节集

置入代码 ({ 131, 228, 248, 81, 81, 86, 87, 139, 125, 8, 139, 15, 133, 201, 15, 132, 177, 0, 0, 0, 139, 85, 12, 139, 18, 133, 210, 15, 132, 164, 0, 0, 0, 139, 69, 16, 139, 0, 133, 192, 15, 132, 151, 0, 0, 0, 131, 57, 1, 15, 133, 137, 0, 0, 0, 131, 58, 1, 15, 133, 128, 0, 0, 0, 131, 56, 1, 117, 123, 139, 73, 4, 133, 201, 116, 112, 131, 120, 4, 0, 116, 106, 59, 72, 4, 116, 4, 106, 252, 235, 103, 197, 254, 111, 74, 8, 51, 246, 131, 225, 224, 118, 26, 139, 7, 197, 245, 239, 68, 48, 8, 139, 69, 16, 139, 0, 197, 254, 127, 68, 48, 8, 131, 198, 32, 59, 241, 114, 230, 139, 7, 139, 64, 4, 131, 224, 31, 137, 68, 36, 12, 59, 240, 197, 248, 119, 115, 36, 139, 69, 12, 139, 214, 139, 15, 131, 226, 31, 139, 0, 138, 84, 2, 8, 139, 69, 16, 50, 84, 49, 8, 139, 0, 136, 84, 48, 8, 70, 59, 116, 36, 12, 114, 220, 51, 192, 235, 12, 106, 253, 235, 2, 106, 254, 88, 235, 3, 131, 200, 255, 95, 94, 139, 229, 93, 194, 12, 0 })
返回 (0)

.版本 2<br /> <br /> .子程序 AAA, 整数型<br /> .参数 data, 字节集<br /> .参数 key, 长整数型, 数组<br /> .参数 DD, 字节集, 参考<br /> <br /> 置入代码 ({ 131, 228, 248, 81, 81, 86, 87, 139, 125, 8, 139, 15, 133, 201, 15, 132, 177, 0, 0, 0, 139, 85, 12, 139, 18, 133, 210, 15, 132, 164, 0, 0, 0, 139, 69, 16, 139, 0, 133, 192, 15, 132, 151, 0, 0, 0, 131, 57, 1, 15, 133, 137, 0, 0, 0, 131, 58, 1, 15, 133, 128, 0, 0, 0, 131, 56, 1, 117, 123, 139, 73, 4, 133, 201, 116, 112, 131, 120, 4, 0, 116, 106, 59, 72, 4, 116, 4, 106, 252, 235, 103, 197, 254, 111, 74, 8, 51, 246, 131, 225, 224, 118, 26, 139, 7, 197, 245, 239, 68, 48, 8, 139, 69, 16, 139, 0, 197, 254, 127, 68, 48, 8, 131, 198, 32, 59, 241, 114, 230, 139, 7, 139, 64, 4, 131, 224, 31, 137, 68, 36, 12, 59, 240, 197, 248, 119, 115, 36, 139, 69, 12, 139, 214, 139, 15, 131, 226, 31, 139, 0, 138, 84, 2, 8, 139, 69, 16, 50, 84, 49, 8, 139, 0, 136, 84, 48, 8, 70, 59, 116, 36, 12, 114, 220, 51, 192, 235, 12, 106, 253, 235, 2, 106, 254, 88, 235, 3, 131, 200, 255, 95, 94, 139, 229, 93, 194, 12, 0 })<br /> 返回 (0)

这个汇编具体是什么作用
在测试中发现  如果使用调试输出查看这个代码转换后的结果
程序就执行不下去   取消输出
代码就没问题
纳闷的很  又不知道这个代码是啥意思  又想调试输出看看  

有能力的大牛帮忙翻译一下   告诉一下具体意思
要是能转成E替代品上传个代码E代码 那就万分感谢了     谢谢

dnxl

你都不知道是干啥用的，你用它干啥

揰掵佲

这不是可以运行嘛

君杰

[Asm] 纯文本查看 复制代码

and esp , 0xFFFFFFF8
push ecx
push ecx
push esi
push edi
mov edi , dword ptr [ebp+0x08]
mov ecx , dword ptr [edi]
test ecx , ecx
je _label_1
mov edx , dword ptr [ebp+0x0C]
mov edx , dword ptr [edx]
test edx , edx
je _label_1
mov eax , dword ptr [ebp+0x10]
mov eax , dword ptr [eax]
test eax , eax
je _label_1
cmp dword ptr [ecx] , 0x01
jne _label_2
cmp dword ptr [edx] , 0x01
jne _label_2
cmp dword ptr [eax] , 0x01
jne _label_2
mov ecx , dword ptr [ecx+0x04]
test ecx , ecx
je _label_3
cmp dword ptr [eax+0x04] , 0x00000000
je _label_3
cmp ecx , dword ptr [eax+0x04]
je _label_4
push 0xFC
jmp _label_5
_label_4
lds edi , esi
outsd 
dec edx
or byte ptr [ebx] , dh
_label_6
test byte ptr [ebx+0x1A76E0E1] , 0x8B
pop es
lds esi , ebp
out dx , eax
inc esp
xor byte ptr [eax] , cl
mov eax , dword ptr [ebp+0x10]
mov eax , dword ptr [eax]
lds edi , esi
jnle _label_3
xor byte ptr [eax] , cl
add esi , 0x20
cmp esi , ecx
jc _label_6
mov eax , dword ptr [edi]
mov eax , dword ptr [eax+0x04]
and eax , 0x1F
mov dword ptr [esp+0x0C] , eax
cmp esi , eax
lds edi , eax
jnbe 0x00010106
_label_7
and al , 0x8B
inc ebp
or al , 0x8B
salc 
mov ecx , dword ptr [edi]
and edx , 0x1F
mov eax , dword ptr [eax]
mov dl , byte ptr [edx+eax+0x08]
mov eax , dword ptr [ebp+0x10]
xor dl , byte ptr [ecx+esi+0x08]
mov eax , dword ptr [eax]
mov byte ptr [eax+esi+0x08] , dl
inc esi
cmp esi , dword ptr [esp+0x0C]
jc _label_7
xor eax , eax
jmp _label_8
_label_3
push 0xFD
jmp _label_5
_label_2
push 0xFE
_label_5
pop eax
jmp _label_8
_label_1
or eax , 0xFFFFFFFF
_label_8
pop edi
pop esi
mov esp , ebp
pop ebp
retn 0x000C

ZJL520

揰掵佲 发表于 2024-11-6 15:33
这不是可以运行嘛

本来就是能运行的  我就是想知道这个属于什么转换  调用程序好像参数三是不是反馈？  你这个列子应该？

ZJL520

君杰 发表于 2024-11-6 15:43
[mw_shl_code=asm,true]and esp , 0xFFFFFFF8
push ecx
push ecx

我想要个复现结果