asm代码如何转换成C语言?

逆向工程 拆卸
2021-07-04 03:44:43

我只是尝试转换如下所示的 asm 代码,但未能得到相同的结果

00ACDE11  /MOV AL,BYTE PTR DS:[EBX]          
00ACDE13  |MOV EDX,EAX                       
00ACDE15  |ADD DL,0CF                        
00ACDE18  |SUB DL,9                          
00ACDE1B  |JB SHORT 00ACDE46            ;Especially this     
00ACDE1D  |ADD DL,0F9                        
00ACDE20  |SUB DL,0E                         
00ACDE23  |JB SHORT 00ACDE46            ;Especially this     
00ACDE25  |DEC EDX                           
00ACDE26  |SUB DL,0B                         
00ACDE29  |JB SHORT 00ACDE46            ;Especially this     
00ACDE2B  |XOR EAX,EAX                       
00ACDE2D  |MOV AL,BYTE PTR SS:[EBP-310]      
00ACDE33  |DEC EAX                           
00ACDE34  |CALL 009E2D24                     
00ACDE39  |MOV EDI,EAX                       
00ACDE3B  |MOV AL,BYTE PTR SS:[EDI+EBP-30F]  
00ACDE42  |MOV BYTE PTR DS:[EBX],AL          
00ACDE44  |JMP SHORT 00ACDE48                
00ACDE46  |MOV BYTE PTR DS:[EBX],AL          
00ACDE48  |INC EBX                           
00ACDE49  |DEC ESI                           
00ACDE4A  \JNZ SHORT 00ACDE11                

我已经在互联网上做了一些研究工作,发现在引起溢出时会设置进位标志。这是我已经尝试过的:

for(int i=0; i < n ;i++)
{
    int c = buffer[i] + 0xC6;

    if(c > 0xFF) // <---- this is not producing the same result
    {
        c = ((unsigned char) c) + 0xEB;

        if(c > 0xFF) // <---- this is not producing the same result
        {
            c = ((unsigned char) c) - 0xC;

            if(c > 0xFF) // <---- this is not producing the same result
            {
                //...
                //func_009E2D24(...);

            }
        }
    }

    //...
}
1个回答

到目前为止,这就是我想要的,这对我来说很好用:

for(int i=0; i < n ;i++)
{
    int c = buffer[i] + 0xCF;
    c = (unsigned char)c;
    c -= 9;
    if (c > 0)
    {
        c += 0xF9;
        c = (unsigned char)c;
        c -= 0xE;
        if (c > 0)
        {
            c = (unsigned char)c;
            c -= 0xC;
            if (c > 0)
            {
                //...
                //func_009E2D24(...);
            }
        }

    }
    //...
}