查看: 1339|回复: 3
|
对汇编感兴趣的朋友看过来
[复制链接]
|
|
有人在某个论坛分享了以下FASM代码,在Linux终端执行会显示"Hello World",可是代码里找不到任何相关syscall指令,也没有"Hello World"字样,何解?
- format elf64 executable
- mov rax,0x3D66206F6C6C6548
- mov rax,0x3D660A646C726F57
- mov rax,0x3D669000000005E8
- mov rax,0x3D6690909090905B
- mov rax,0x3D66909090DE8948
- mov rax,0x3D669090E7C68348
- mov rax,0x3D669000000006BA
- mov rax,0x3D669000000001B8
- mov rax,0x3D669000000001BF
- mov rax,0x3D6690909090050F
- mov rax,0x3D66909090DE8948
- mov rax,0x3D669090F1C68348
- mov rax,0x3D669000000006BA
- mov rax,0x3D669000000001B8
- mov rax,0x3D669000000001BF
- mov rax,0x3D6690909090050F
- mov rax,0x3D6690000000E7B8
- mov rax,0x3D6690909090050F
- jmp $-0x9e
复制代码
|
评分
-
查看全部评分
|
|
|
|
|
|
|
楼主 |
发表于 21-6-2023 08:04 PM
|
显示全部楼层
|
|
|
|
|
|
|
楼主 |
发表于 22-6-2023 09:00 PM
|
显示全部楼层
只需稍微改一改,反汇编器如IDA就能正确显示:
- format elf64 executable
- mov rax,0x3D66206F6C6C6548
- mov rax,0x3D660A646C726F57
- ;mov rax,0x3D669000000005E8
- ;db 0x48
- ;db 0xb8
- nop
- nop
- dq 0x3D669000000005E8
- mov rax,0x3D6690909090905B
- mov rax,0x3D66909090DE8948
- mov rax,0x3D669090E7C68348
- mov rax,0x3D669000000006BA
- mov rax,0x3D669000000001B8
- mov rax,0x3D669000000001BF
- mov rax,0x3D6690909090050F
- mov rax,0x3D66909090DE8948
- mov rax,0x3D669090F1C68348
- mov rax,0x3D669000000006BA
- mov rax,0x3D669000000001B8
- mov rax,0x3D669000000001BF
- mov rax,0x3D6690909090050F
- mov rax,0x3D6690000000E7B8
- mov rax,0x3D6690909090050F
- ;jmp $-0x9e
复制代码 |
评分
-
查看全部评分
|
|
|
|
|
|
|
楼主 |
发表于 23-6-2023 03:42 PM
|
显示全部楼层
还有一个类似的,但是更难反编译:
- format elf64 executable
- mov rax,0x02EB206F6C6C6548
- mov rax,0x02EB0A646C726F57
- mov rax,0x9003EB00000005E8
- mov rax,0x909090909007EB5B
- mov rax,0x909004EBE7738D48
- mov rax,0x9003EB00000006BA
- mov rax,0x9003EB00000001B8
- mov rax,0x9003EB00000001BF
- mov rax,0x9090909006EB050F
- mov rax,0x909004EBF1738D48
- mov rax,0x9003EB00000006BA
- mov rax,0x9003EB00000001B8
- mov rax,0x9003EB00000001BF
- mov rax,0x9090909006EB050F
- mov rax,0x9003EB000000E7B8
- mov rax,0x9090909006EB050F
- jmp $$ + 22
复制代码 |
评分
-
查看全部评分
|
|
|
|
|
|
| |
本周最热论坛帖子
|