对汇编感兴趣的朋友看过来

褐眼睛

有人在某个论坛分享了以下FASM代码，在Linux终端执行会显示"Hello World"，可是代码里找不到任何相关syscall指令，也没有"Hello World"字样，何解？

1. format elf64 executable
   
2. mov rax,0x3D66206F6C6C6548
   
3. mov rax,0x3D660A646C726F57
   
4. mov rax,0x3D669000000005E8
   
5. mov rax,0x3D6690909090905B
   
6. mov rax,0x3D66909090DE8948
   
7. mov rax,0x3D669090E7C68348
   
8. mov rax,0x3D669000000006BA
   
9. mov rax,0x3D669000000001B8
   
10. mov rax,0x3D669000000001BF
    
11. mov rax,0x3D6690909090050F
    
12. mov rax,0x3D66909090DE8948
    
13. mov rax,0x3D669090F1C68348
    
14. mov rax,0x3D669000000006BA
    
15. mov rax,0x3D669000000001B8
    
16. mov rax,0x3D669000000001BF
    
17. mov rax,0x3D6690909090050F
    
18. mov rax,0x3D6690000000E7B8
    
19. mov rax,0x3D6690909090050F
    
20. jmp $-0x9e   

复制代码

褐眼睛

据称是用了这样的工具：
https://github.com/xoreaxeaxeax/movfuscator

褐眼睛

只需稍微改一改，反汇编器如IDA就能正确显示：

1. format elf64 executable
   
2. mov rax,0x3D66206F6C6C6548
   
3. mov rax,0x3D660A646C726F57
   
4. 
   
5. ;mov rax,0x3D669000000005E8
   
6. 
   
7. ;db 0x48
   
8. ;db 0xb8
   
9. nop
   
10. nop
    
11. dq 0x3D669000000005E8
    
12. 
    
13. mov rax,0x3D6690909090905B
    
14. mov rax,0x3D66909090DE8948
    
15. mov rax,0x3D669090E7C68348
    
16. mov rax,0x3D669000000006BA
    
17. mov rax,0x3D669000000001B8
    
18. mov rax,0x3D669000000001BF
    
19. mov rax,0x3D6690909090050F
    
20. mov rax,0x3D66909090DE8948
    
21. mov rax,0x3D669090F1C68348
    
22. mov rax,0x3D669000000006BA
    
23. mov rax,0x3D669000000001B8
    
24. mov rax,0x3D669000000001BF
    
25. mov rax,0x3D6690909090050F
    
26. mov rax,0x3D6690000000E7B8
    
27. mov rax,0x3D6690909090050F
    
28. ;jmp $-0x9e              

复制代码

褐眼睛

还有一个类似的，但是更难反编译：

1. format elf64 executable
   
2. mov rax,0x02EB206F6C6C6548
   
3. mov rax,0x02EB0A646C726F57
   
4. mov rax,0x9003EB00000005E8
   
5. mov rax,0x909090909007EB5B
   
6. mov rax,0x909004EBE7738D48
   
7. mov rax,0x9003EB00000006BA
   
8. mov rax,0x9003EB00000001B8
   
9. mov rax,0x9003EB00000001BF
   
10. mov rax,0x9090909006EB050F
    
11. mov rax,0x909004EBF1738D48
    
12. mov rax,0x9003EB00000006BA
    
13. mov rax,0x9003EB00000001B8
    
14. mov rax,0x9003EB00000001BF
    
15. mov rax,0x9090909006EB050F
    
16. mov rax,0x9003EB000000E7B8
    
17. mov rax,0x9090909006EB050F
    
18. jmp $$ + 22   

复制代码