vmware·Î winxp¼³Ä¡ Å°Á¨ »ç¿ë¹ý - »ç¿ëÀÚÀ̸§ ¶È°°ÀÌ ¾²°í edit plus¿¡µµ »ç¿ëÀÚÀ̸§ ¶È°°ÀÌ ±×¸®°í Å°Á¨ ±×¸®°í µî·ÏÄÚµå ÀÔ·Â win xp¿¡¼­ Çؾ߸¸ ÇÑ´Ù. 1.µµ±¸ - »ç¿ëÀÚ µµ±¸ ±¸¼º 2.ÇÁ·Î±×·¥ ÆÄÀÏ¿¡ ¿¡µðÅÍ Ç÷¯½º¸¦ º¹»ç½ÃÄѼ­ ÀÌ¿ë 3. µµ±¸ - »ç¿ëÀÚ µµ±¸ ±¸¼º ¹®¼­ÅÛÇø´ ÅÛÇ÷¯ È£Ãâ µÚ asmÀ¸·Î º¯È¯ ÄÚµù¿Ï·á --------------------------------------------------------------- ÄÄÆÄÀÏ·¯ ¼³Ä¡ masm ¾ÐÃàÇ®°í ¼³Ä¡ cmd - ml - ³»ÄÄÇ»ÅÍ - °ü¸® - °í±Þ - ȯ°æº¯¼ö - path - ;C:\masm32\bin Ãß°¡ --------------------------------------------------------------- ÄÄÆÄÀÏ ¹æ¹ý ml /c /coff/ Zi ÆÄÀϸí.asm /c = ÄÄÆÄÀϸ¸ ÇÏ°Ú´Ù. ¤Ó /coff = ¿ÀºêÁ§Æ®ÆÄÀÏÀ» »ý¼ºÇÏ°Ú´Ù. ¤Ó== obj ÆÄÀÏ »ý¼º /Zi = Debug Á¤º¸¸¦ ³Ö°Ú´Ù. ¤Ó ¸µÅ© °Å´Â ¹æ¹ý ¤Ó link /subsystem:windows ÆÄÀϸí.obj ¤Ó == exeÆÄÀÏ »ý¼º ¤Ó link¶õ ÇϳªÀÇ ¿î¿µÃ¼Á¦¿¡¼­ ¿î¿µÇÒ¼öÀÖ°Ô ¸¸µé¾îÁÖ´Â exeÆÄÀÏ // ¸¸¾à»À´ë°¡ ÀÖ´Ù¸é »ìÀ» ºÙ¿©ÁÖ´Â °Í Å°»çȨÆäÀÌÁö - ÇØÅ·´ëȸ µµ±¸ -»ç¿ëÀÚ µµ±¸ ¼³Á¤ - »ç¿ëÀÚµµ±¸ - Ãß°¡ - ÇÁ·Î±×·¥ - ¸Þ´ºÁ¦¸ñ : asm_com - ¸í·É : C:\masm32\bin\ml.exe- Àμö : /c /coff /Zi ÆÄÀϸí - µð·ºÅ丮 : ÆÄÀϵð·ºÅ丮 µµ±¸ - »ç¿ëÀÚ µµ±¸ ¼³Á¤ - »ç¿ëÀÚ µµ±¸ - Ãß°¡ - ÇÁ·Î±×·¥ ¸Þ´ºÁ¦¸ñ : asm_link - ¸í·É :C:\masm32\bin\link.exe- ¸í·É : /subsystem:windows $(FileNameNoExt).obj- µð·ºÅ丮 : ÆÄÀϵð·ºÅ丮 $(FileNameNoExt) - ÆÄÀϸíÀ»»« µð·ºÅ丮 --------------------------------------------------------------- ollydbg ¾ÐÃàÇ®±â ollydbg ½ÇÇà ¿É¼Ç 1¹ø° - µð·ºÅ丮 - udd ,plug À§Ä¡ ¿Å±â±â ¿ø·¡ ÀÖ¾ú´øµ¥·Î. -------------------------------------------------------------------------------- .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp push eax push ebx push ecx pop ecx pop ebx pop eax mov esp, ebp pop ebp ret main endp end main --------------------------------------------- .586 = cpu¹öÁ¯Á¤º¸ .model flat = memory ¸ðµ¨ .stdcall = ÇÔ¼öÈ£Ãâ ±Ô¾à(ÇÔ¼öÈ£Ãâ¹æ½Ä) option casemap:none = ¿µ¹®ÀÚ ´ë¼Ò±¸ºÐÇÏÁö ¾Ê°Ú´Ù .code = ¾Æ·¡¿¡ ÀÖ´Â ÄÚµåµéÀ» ÄÚµå ¿µ¿ª¿¡ ³Ö°Ú´Ù main proc = ¸ÞÀÎ ÇÁ·Î½ÃÀúÀÇ ¾àÀÚ c¾ð¾îÀÇ int main()°ú °°À½, ¸ÞÀÎ ÇÔ¼öÀÇ ½ÃÀÛ main endp = ¸ÞÀÎ ¿£µåÇÁ·Î½ÃÀú ¸ÞÀÎÇÔ¼öÀÇ ³¡ end main = ¿ÏÀüÇÑ Á¾·á ebp¸¦ ³Ö°Ú´Ù - esp¸¦ ebp¿¡ ³Ö°Ú´Ù - eax³Ö°í - ebx ³Ö°í - ecx ³Ö°í - ecx »©°í - ebx »©°í - eax »©°í - ebp¸¦ esp¿¡ ³Ö°Ú´Ù - ebp¸¦ »©°Ú´Ù. h = 16Áø¼ö 10 b = 2Áø¼ö o = 10Áø¼ö .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp mov eax, 10h mov ebx, 10 mov ecx, 10b mov edx, 10o push eax pop ebx push ebx push ecx pop edx mov esp, ebp pop ebp ret main endp end main ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp mov eax, 0 ; mov al, 101th push eax mov ah, 11 pop ebx mov al, 0A1h push eax pop ebx mov cx, 241fh push ecx pop ecx mov bh, 0c3h push ebx mov dx, ax push edx mov esp, ebp pop ebp ret main endp end main ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp mov ax, 1234h movzx ebx, ax mov ax, 5678h ; +5678 movsx ecx, ax mov ax, -5678h ; -5678 movsx edx, ax mov esp, ebp pop ebp ret main endp end main movsx - ·¹Áö - sined ·Î º¸°Ú´Ù. 1À̶ó´Â ºÎÈ£ºñÆ®·Î È®Àå movzx -·¹Áö - unsined °ªÀ»¾µ¶§ 0À̶ó´Â ºÎÈ£ºñÆ®¸¦ ¾²¸é¼­ È®Àå ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp sub esp, 8h mov dword ptr[ebp-4], 12345678h mov dword ptr[ebp-8], 87654321h lea esi, dword ptr[ebp-4] - esi¿¡ ebp-4À̶ó´Â ÁÖ¼Ò¸¦ º¹»çÇÏ°Ú´Ù. // µé¾î°¬´Ù³ª¿È mov edi, dword ptr[esi] - edi¿¡ esi(12345678h)¶ó´Â °ªÀ» º¹»çÇÏ°Ú´Ù.//µé¾î°¨ lea eax, dword ptr[ebp-8] - eax¿¡ ebp-8À̶ó´Â ÁÖ¼Ò¸¦ º¹»çÇÏ°Ú´Ù. // µé¾î°¬´Ù³ª¿È mov ebx, dword ptr[eax] - - eax¿¡¼­ esi(87654321h)¶ó´Â °ªÀ» º¹»çÇÏ°Ú´Ù.//µé¾î°¨ mov esp, ebp pop ebp ret main endp end main sub = ´Ü¼ø »©±â esp°ªÀ» 8¸¸Å­ »©°Ú´Ù. lea = ÁÖ¼Ò¸¦ º¹»ç mov = °ªÀ» º¹»ç dword ptr[ebp-4] 12345678h= 12345678h¸¦ 4¹ÙÀÌÆ® ¸¸Å­À» dwordÇüÅ·Πº¸°Ú´Ù. ÂüÁ¶ÇÏ°Ú´Ù. - 96À» 4¹ÙÀÌÆ® ¸¸Å­ ÂüÁ¶ÇÏ°Ú´Ù. dword ptr[ebp-8] 87654321h= 87654321h¸¦ 4¹ÙÀÌÆ® ¸¸Å­Àº dwordÇüÅ·Πº¸°Ú´Ù. ÂüÁ¶ÇÏ°Ú´Ù. - 92±îÁö¸¦ 4¹ÙÀÌÆ®¸¸Å­ ÂüÁ¶ÇÏ°Ú´Ù. ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ movsd - ¹®ÀÚ¿­ º¹»ç move string dword .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp sub esp,8h mov dword ptr[ebp-4], 31323334h mov dword ptr[ebp-8], 00000000h mov esi, dword ptr[ebp-4] - mov edi, dword ptr[ebp-8] lea esi, dword ptr[ebp-4] - 31323334h¸¦ µ¥½ºÆ¼³×À̼ÇÀ¸·Î º¹»ç¿Ã¶ó°¨. lea edi, dword ptr[ebp-8] - 00000000h´Â µ¥½ºÆ¼³×ÀÌ¼Ç movsd mov esp, ebp pop ebp ret main endp end main ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp sub esp,8h mov dword ptr[ebp-4], 31323334h mov dword ptr[ebp-8], 00000000h mov esi, dword ptr[ebp-4] mov edi, dword ptr[ebp-8] lea esi, dword ptr[ebp-4] lea edi, dword ptr[ebp-8] mov ecx, 4h - ecx¿¡ 4¸¦ »ðÀÔ 1¹ø µ¹¸±¶§¸¶´Ù ecx°¡ 1³ª¾¿ °¨¼Ò rep movsb - ÇÑÁٹݺ¹ mov esp, ebp pop ebp ret main endp end main ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ ³»°¡Â§ ÄÚµåÇ¥ 1. ½ºÆåÇÁ·¹ÀÓ ¼³Á¤ 2. Áö¿ªº¯¼ö ¼³Á¤ (4,4,8 3°³ÀÇ Áö¿ªº¯¼ö) 3. ù¹ø° Áö¿ªº¯¼ö 31323334h¸¦ ³Ö´Â´Ù 4. µÎ¹ø° Áö¿ªº¯¼ö 35363738h¸¦ ³Ö´Â´Ù. 5. ù¹ø° Áö¿ªº¯¼öÀÇ °ª Àüü¸¦ movsb¸¦ »ç¿ëÇÏ¿© 3¹ø° Áö¿ªº¯¼ö¿¡ ³Ö´Â´Ù. 6. 3¹ø° Áö¿ªº¯¼öÀÇ 5¸¦ ½ÇÇàÇÏ°í ³²Àº °ø°£¿¡ µÎ¹ø° Áö¿ªº¯¼öÀÇ °ªÀ» movsw¸¦ ÀÌ¿ëÇÏ¿© ³Ö´Â´Ù. 7. ½ºÆçÇÁ·¹ÀÓÁ¤¸® .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp sub esp, 16 mov dword ptr[ebp-4], 31323334h mov dword ptr[ebp-8], 35363738h mov dword ptr[ebp-16], 00000000h lea esi, dword ptr[ebp-4] lea edi, dword ptr[ebp-16] mov ecx, 4h rep movsb lea esi, dword ptr[ebp-8] lea edi, dword ptr[ebp-16] mov ecx, 2h rep movsw mov esp, ebp pop ebp ret main endp end main ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ¤Ñ ¼±»ý´ÔÀÌ Â§ ÄÚµå .586 .model flat, stdcall option casemap:none .code main proc push ebp mov ebp, esp sub esp, 10h mov dword ptr[ebp-4], 31323334h mov dword ptr[ebp-8], 35363738h lea esi, dword ptr[ebp-4] lea edi, dword ptr[ebp-10h] mov ecx, 4 rep movsb lea esi, dword ptr[ebp-8] mov ecx, 2 rep movsw mov esp, ebp pop ebp ret main endp end main