You last visited: Today at 04:46
Advertisement
Auf der Suche nach einem Profi im Bereich "ASM".
Discussion on Auf der Suche nach einem Profi im Bereich "ASM". within the General Coding forum part of the Coders Den category.
01/08/2010, 15:36
#1
elite*gold: 0
Join Date: Feb 2009
Posts: 172
Received Thanks: 70
Auf der Suche nach einem Profi im Bereich "ASM".
Hallo,
01/08/2010, 16:12
#2
elite*gold: 0
Join Date: Apr 2007
Posts: 2,399
Received Thanks: 6,646
Wäre vielleicht von Vorteil wenn du den
01/09/2010, 02:36
#3
elite*gold: 0
Join Date: Feb 2009
Posts: 172
Received Thanks: 70
Ich kann das gerne tun. Jedoch ist diese Routine ziemlich groß. Ich habe diverse "Pseudo-C-Code-Generatoren" genutzt. Ist zwar kürzer aber ebenso unverständlich.
Code:
00B2C150 55 PUSH EBP
00B2C151 |. 8BEC MOV EBP,ESP
00B2C153 |. 81EC 0C050000 SUB ESP,50C
00B2C159 |. A1 C070D900 MOV EAX,DWORD PTR DS:[D970C0]
00B2C15E |. 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX
00B2C161 |. 56 PUSH ESI
00B2C162 |. 57 PUSH EDI
00B2C163 |. 898D F4FAFFFF MOV DWORD PTR SS:[EBP-50C],ECX
00B2C169 |. C785 14FDFFFF >MOV DWORD PTR SS:[EBP-2EC],0
00B2C173 |. 66:C785 24FDFF>MOV WORD PTR SS:[EBP-2DC],0
00B2C17C |. 66:C745 EC 000>MOV WORD PTR SS:[EBP-14],0
00B2C182 |. C785 20FDFFFF >MOV DWORD PTR SS:[EBP-2E0],0
00B2C18C |. C745 F0 000000>MOV DWORD PTR SS:[EBP-10],0
00B2C193 |. C685 28FDFFFF >MOV BYTE PTR SS:[EBP-2D8],0
00B2C19A |. B9 AE000000 MOV ECX,0AE
00B2C19F |. 33C0 XOR EAX,EAX
00B2C1A1 |. 8DBD 29FDFFFF LEA EDI,DWORD PTR SS:[EBP-2D7]
00B2C1A7 |. F3:AB REP STOS DWORD PTR ES:[EDI]
00B2C1A9 |. 66:AB STOS WORD PTR ES:[EDI]
00B2C1AB |. AA STOS BYTE PTR ES:[EDI]
00B2C1AC |. 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]
00B2C1AF |. 8B48 21 MOV ECX,DWORD PTR DS:[EAX+21]
00B2C1B2 |. 898D 1CFDFFFF MOV DWORD PTR SS:[EBP-2E4],ECX
00B2C1B8 |. 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10]
00B2C1BB |. 8B42 18 MOV EAX,DWORD PTR DS:[EDX+18]
00B2C1BE |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
00B2C1C1 |> 8B8D 20FDFFFF /MOV ECX,DWORD PTR SS:[EBP-2E0]
00B2C1C7 |. 3B4D 08 |CMP ECX,DWORD PTR SS:[EBP+8]
00B2C1CA |. 0F83 900C0000 |JNB XXXXXX.00B2CE60
00B2C1D0 |. 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8]
00B2C1D3 |. 2B95 20FDFFFF |SUB EDX,DWORD PTR SS:[EBP-2E0]
00B2C1D9 |. 83FA 09 |CMP EDX,9
00B2C1DC |. 0F83 0B040000 |JNB XXXXXX.00B2C5ED
00B2C1E2 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C1E8 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C1EE |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C1F4 |. 0FB69401 1E010>|MOVZX EDX,BYTE PTR DS:[ECX+EAX+11E]
00B2C1FC |. 83FA 01 |CMP EDX,1
00B2C1FF |. 0F85 B0000000 |JNZ XXXXXX.00B2C2B5
00B2C205 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C20B |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C211 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C217 |. C68401 1F01000>|MOV BYTE PTR DS:[ECX+EAX+11F],1
00B2C21F |. 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8]
00B2C222 |. 2B95 20FDFFFF |SUB EDX,DWORD PTR SS:[EBP-2E0]
00B2C228 |. 52 |PUSH EDX ; /n
00B2C229 |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10] ; |
00B2C22C |. 50 |PUSH EAX ; |src
00B2C22D |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4] ; |
00B2C233 |. 69C9 17400000 |IMUL ECX,ECX,4017 ; |
00B2C239 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C] ; |
00B2C23F |. 8D840A 1E01000>|LEA EAX,DWORD PTR DS:[EDX+ECX+11E] ; |
00B2C246 |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4] ; |
00B2C24C |. 69C9 17400000 |IMUL ECX,ECX,4017 ; |
00B2C252 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C] ; |
00B2C258 |. 8B8C0A 2941000>|MOV ECX,DWORD PTR DS:[EDX+ECX+4129] ; |
00B2C25F |. 8D5408 02 |LEA EDX,DWORD PTR DS:[EAX+ECX+2] ; |
00B2C263 |. 52 |PUSH EDX ; |dest
00B2C264 |. E8 9737DDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2C269 |. 83C4 0C |ADD ESP,0C
00B2C26C |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C272 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C278 |. 8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00B2C27B |. 2B8D 20FDFFFF |SUB ECX,DWORD PTR SS:[EBP-2E0]
00B2C281 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C287 |. 038C02 2941000>|ADD ECX,DWORD PTR DS:[EDX+EAX+4129]
00B2C28E |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C294 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C29A |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C2A0 |. 898C02 2941000>|MOV DWORD PTR DS:[EDX+EAX+4129],ECX
00B2C2A7 |. 8B45 08 |MOV EAX,DWORD PTR SS:[EBP+8]
00B2C2AA |. 8985 20FDFFFF |MOV DWORD PTR SS:[EBP-2E0],EAX
00B2C2B0 |. E9 33030000 |JMP XXXXXX.00B2C5E8
00B2C2B5 |> 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4]
00B2C2BB |. 69C9 17400000 |IMUL ECX,ECX,4017
00B2C2C1 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C2C7 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C2CD |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C2D3 |. 8B9410 3141000>|MOV EDX,DWORD PTR DS:[EAX+EDX+4131]
00B2C2DA |. 0355 08 |ADD EDX,DWORD PTR SS:[EBP+8]
00B2C2DD |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C2E3 |. 399408 2D41000>|CMP DWORD PTR DS:[EAX+ECX+412D],EDX
00B2C2EA |. 0F87 6D020000 |JA XXXXXX.00B2C55D
00B2C2F0 |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4]
00B2C2F6 |. 69C9 17400000 |IMUL ECX,ECX,4017
00B2C2FC |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C302 |. 8B840A 2D41000>|MOV EAX,DWORD PTR DS:[EDX+ECX+412D]
00B2C309 |. 8985 18FDFFFF |MOV DWORD PTR SS:[EBP-2E8],EAX
00B2C30F |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4]
00B2C315 |. 69C9 17400000 |IMUL ECX,ECX,4017
00B2C31B |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C321 |. 8B840A 3141000>|MOV EAX,DWORD PTR DS:[EDX+ECX+4131]
00B2C328 |. 50 |PUSH EAX ; /n
00B2C329 |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4] ; |
00B2C32F |. 69C9 17400000 |IMUL ECX,ECX,4017 ; |
00B2C335 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C] ; |
00B2C33B |. 8D840A 2001000>|LEA EAX,DWORD PTR DS:[EDX+ECX+120] ; |
00B2C342 |. 50 |PUSH EAX ; |src
00B2C343 |. 8D8D 28FDFFFF |LEA ECX,DWORD PTR SS:[EBP-2D8] ; |
00B2C349 |. 51 |PUSH ECX ; |dest
00B2C34A |. E8 B136DDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2C34F |. 83C4 0C |ADD ESP,0C
00B2C352 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C358 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C35E |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C364 |. 8B8D 18FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E8]
00B2C36A |. 2B8C10 3141000>|SUB ECX,DWORD PTR DS:[EAX+EDX+4131]
00B2C371 |. 51 |PUSH ECX ; /n
00B2C372 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] ; |
00B2C375 |. 52 |PUSH EDX ; |src
00B2C376 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4] ; |
00B2C37C |. 69C0 17400000 |IMUL EAX,EAX,4017 ; |
00B2C382 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2C388 |. 8B9401 3141000>|MOV EDX,DWORD PTR DS:[ECX+EAX+4131] ; |
00B2C38F |. 8D8415 28FDFFF>|LEA EAX,DWORD PTR SS:[EBP+EDX-2D8] ; |
00B2C396 |. 50 |PUSH EAX ; |dest
00B2C397 |. E8 6436DDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2C39C |. 83C4 0C |ADD ESP,0C
00B2C39F |. 8D8D 28FDFFFF |LEA ECX,DWORD PTR SS:[EBP-2D8]
00B2C3A5 |. 898D 10FDFFFF |MOV DWORD PTR SS:[EBP-2F0],ECX
00B2C3AB |. 8B95 28FDFFFF |MOV EDX,DWORD PTR SS:[EBP-2D8]
00B2C3B1 |. 8955 F4 |MOV DWORD PTR SS:[EBP-C],EDX
00B2C3B4 |. 8B85 2CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2D4]
00B2C3BA |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX
00B2C3BD |. 8A8D 30FDFFFF |MOV CL,BYTE PTR SS:[EBP-2D0]
00B2C3C3 |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
00B2C3C6 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C3CC |. 0FB682 1D01000>|MOVZX EAX,BYTE PTR DS:[EDX+11D]
00B2C3D3 |. 83F8 01 |CMP EAX,1
00B2C3D6 |. 75 12 |JNZ SHORT XXXXXX.00B2C3EA
00B2C3D8 |. 8B8D 10FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2F0]
00B2C3DE |. 51 |PUSH ECX ; /Arg1
00B2C3DF |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2C3E5 |. E8 260E0000 |CALL XXXXXX.00B2D210 ; \XXXXXX.00B2D210
00B2C3EA |> 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2C3EE |. 81FA EA130000 |CMP EDX,13EA
00B2C3F4 |. 7C 4B |JL SHORT XXXXXX.00B2C441
00B2C3F6 |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2C3FA |. 3D EF130000 |CMP EAX,13EF
00B2C3FF |. 7F 40 |JG SHORT XXXXXX.00B2C441
00B2C401 |. C685 A8FCFFFF >|MOV BYTE PTR SS:[EBP-358],0
00B2C408 |. B9 18000000 |MOV ECX,18
00B2C40D |. 33C0 |XOR EAX,EAX
00B2C40F |. 8DBD A9FCFFFF |LEA EDI,DWORD PTR SS:[EBP-357]
00B2C415 |. F3:AB |REP STOS DWORD PTR ES:[EDI]
00B2C417 |. 66:AB |STOS WORD PTR ES:[EDI]
00B2C419 |. AA |STOS BYTE PTR ES:[EDI]
00B2C41A |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2C41E |. 51 |PUSH ECX ; /<%d>
00B2C41F |. 68 80E3CE00 |PUSH XXXXXX.00CEE380 ; |format = "Recv Paacket Header %d
"
00B2C424 |. 8D95 A8FCFFFF |LEA EDX,DWORD PTR SS:[EBP-358] ; |
00B2C42A |. 52 |PUSH EDX ; |s
00B2C42B |. FF15 B8C4BC00 |CALL DWORD PTR DS:[<&MSVCR71.sprintf>] ; \sprintf
00B2C431 |. 83C4 0C |ADD ESP,0C
00B2C434 |. 8D85 A8FCFFFF |LEA EAX,DWORD PTR SS:[EBP-358]
00B2C43A |. 50 |PUSH EAX ; /String
00B2C43B |. FF15 08C2BC00 |CALL DWORD PTR DS:[<&KERNEL32.OutputDeb>; \OutputDebugStringA
00B2C441 |> 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2C445 |. 81F9 6F170000 |CMP ECX,176F
00B2C44B |. 74 2F |JE SHORT XXXXXX.00B2C47C
00B2C44D |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2C451 |. 81FA 6B170000 |CMP EDX,176B
00B2C457 |. 74 23 |JE SHORT XXXXXX.00B2C47C
00B2C459 |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2C45D |. 3D 6C170000 |CMP EAX,176C
00B2C462 |. 74 18 |JE SHORT XXXXXX.00B2C47C
00B2C464 |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2C468 |. 81F9 6D170000 |CMP ECX,176D
00B2C46E |. 74 0C |JE SHORT XXXXXX.00B2C47C
00B2C470 |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2C474 |. 81FA 6E170000 |CMP EDX,176E
00B2C47A |. 75 22 |JNZ SHORT XXXXXX.00B2C49E
00B2C47C |> 8B45 10 |MOV EAX,DWORD PTR SS:[EBP+10]
00B2C47F |. 8B48 21 |MOV ECX,DWORD PTR DS:[EAX+21]
00B2C482 |. 51 |PUSH ECX ; /Arg3
00B2C483 |. 66:8B95 18FDFF>|MOV DX,WORD PTR SS:[EBP-2E8] ; |
00B2C48A |. 52 |PUSH EDX ; |Arg2
00B2C48B |. 8B85 10FDFFFF |MOV EAX,DWORD PTR SS:[EBP-2F0] ; |
00B2C491 |. 50 |PUSH EAX ; |Arg1
00B2C492 |. B9 ECB17901 |MOV ECX,XXXXXX.0179B1EC ; |
00B2C497 |. E8 94110000 |CALL XXXXXX.00B2D630 ; \XXXXXX.00B2D630
00B2C49C |. EB 20 |JMP SHORT XXXXXX.00B2C4BE
00B2C49E |> 8B4D 10 |MOV ECX,DWORD PTR SS:[EBP+10]
00B2C4A1 |. 8B51 21 |MOV EDX,DWORD PTR DS:[ECX+21]
00B2C4A4 |. 52 |PUSH EDX ; /Arg3
00B2C4A5 |. 66:8B85 18FDFF>|MOV AX,WORD PTR SS:[EBP-2E8] ; |
00B2C4AC |. 50 |PUSH EAX ; |Arg2
00B2C4AD |. 8B8D 10FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2F0] ; |
00B2C4B3 |. 51 |PUSH ECX ; |Arg1
00B2C4B4 |. B9 B4B17901 |MOV ECX,XXXXXX.0179B1B4 ; |
00B2C4B9 |. E8 72110000 |CALL XXXXXX.00B2D630 ; \XXXXXX.00B2D630
00B2C4BE |> 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C4C4 |. 81C2 14010000 |ADD EDX,114
00B2C4CA |. 52 |PUSH EDX ; /pVar
00B2C4CB |. FF15 F4C0BC00 |CALL DWORD PTR DS:[<&KERNEL32.Interlock>; \InterlockedIncrement
00B2C4D1 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C4D7 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C4DD |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C4E3 |. 8B95 18FDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E8]
00B2C4E9 |. 2B9401 3141000>|SUB EDX,DWORD PTR DS:[ECX+EAX+4131]
00B2C4F0 |. 0395 20FDFFFF |ADD EDX,DWORD PTR SS:[EBP-2E0]
00B2C4F6 |. 8995 20FDFFFF |MOV DWORD PTR SS:[EBP-2E0],EDX
00B2C4FC |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C502 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C508 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C50E |. 8B95 18FDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E8]
00B2C514 |. 2B9401 3141000>|SUB EDX,DWORD PTR DS:[ECX+EAX+4131]
00B2C51B |. 0355 F0 |ADD EDX,DWORD PTR SS:[EBP-10]
00B2C51E |. 8955 F0 |MOV DWORD PTR SS:[EBP-10],EDX
00B2C521 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C527 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C52D |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C533 |. C78401 3141000>|MOV DWORD PTR DS:[ECX+EAX+4131],0
00B2C53E |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C544 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C54A |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C550 |. C68410 1E01000>|MOV BYTE PTR DS:[EAX+EDX+11E],1
00B2C558 |. E9 8B000000 |JMP XXXXXX.00B2C5E8
00B2C55D |> 8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00B2C560 |. 51 |PUSH ECX ; /n
00B2C561 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] ; |
00B2C564 |. 52 |PUSH EDX ; |src
00B2C565 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4] ; |
00B2C56B |. 69C0 17400000 |IMUL EAX,EAX,4017 ; |
00B2C571 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2C577 |. 8D9401 1E01000>|LEA EDX,DWORD PTR DS:[ECX+EAX+11E] ; |
00B2C57E |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4] ; |
00B2C584 |. 69C0 17400000 |IMUL EAX,EAX,4017 ; |
00B2C58A |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2C590 |. 8B8401 3141000>|MOV EAX,DWORD PTR DS:[ECX+EAX+4131] ; |
00B2C597 |. 8D4C02 02 |LEA ECX,DWORD PTR DS:[EDX+EAX+2] ; |
00B2C59B |. 51 |PUSH ECX ; |dest
00B2C59C |. E8 5F34DDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2C5A1 |. 83C4 0C |ADD ESP,0C
00B2C5A4 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C5AA |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C5B0 |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C5B6 |. 8B8C10 3141000>|MOV ECX,DWORD PTR DS:[EAX+EDX+4131]
00B2C5BD |. 034D 08 |ADD ECX,DWORD PTR SS:[EBP+8]
00B2C5C0 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C5C6 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C5CC |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C5D2 |. 898C10 3141000>|MOV DWORD PTR DS:[EAX+EDX+4131],ECX
00B2C5D9 |. 8B8D 20FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E0]
00B2C5DF |. 034D 08 |ADD ECX,DWORD PTR SS:[EBP+8]
00B2C5E2 |. 898D 20FDFFFF |MOV DWORD PTR SS:[EBP-2E0],ECX
00B2C5E8 |>^E9 D4FBFFFF |JMP XXXXXX.00B2C1C1
00B2C5ED |> 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C5F3 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C5F9 |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C5FF |. 0FB68C10 1E010>|MOVZX ECX,BYTE PTR DS:[EAX+EDX+11E]
00B2C607 |. 83F9 01 |CMP ECX,1
00B2C60A |. 0F85 37040000 |JNZ XXXXXX.00B2CA47
00B2C610 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C616 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C61C |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C622 |. 0FB68C10 1F010>|MOVZX ECX,BYTE PTR DS:[EAX+EDX+11F]
00B2C62A |. 83F9 01 |CMP ECX,1
00B2C62D |. 0F85 B9000000 |JNZ XXXXXX.00B2C6EC
00B2C633 |. 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8]
00B2C636 |. 52 |PUSH EDX ; /n
00B2C637 |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10] ; |
00B2C63A |. 50 |PUSH EAX ; |src
00B2C63B |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4] ; |
00B2C641 |. 69C9 17400000 |IMUL ECX,ECX,4017 ; |
00B2C647 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C] ; |
00B2C64D |. 8D840A 1E01000>|LEA EAX,DWORD PTR DS:[EDX+ECX+11E] ; |
00B2C654 |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4] ; |
00B2C65A |. 69C9 17400000 |IMUL ECX,ECX,4017 ; |
00B2C660 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C] ; |
00B2C666 |. 8B8C0A 2941000>|MOV ECX,DWORD PTR DS:[EDX+ECX+4129] ; |
00B2C66D |. 8D5408 02 |LEA EDX,DWORD PTR DS:[EAX+ECX+2] ; |
00B2C671 |. 52 |PUSH EDX ; |dest
00B2C672 |. E8 8933DDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2C677 |. 83C4 0C |ADD ESP,0C
00B2C67A |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C680 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C686 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C68C |. 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8]
00B2C68F |. 039401 2941000>|ADD EDX,DWORD PTR DS:[ECX+EAX+4129]
00B2C696 |. 8955 08 |MOV DWORD PTR SS:[EBP+8],EDX
00B2C699 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C69F |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C6A5 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C6AB |. 8D9401 2001000>|LEA EDX,DWORD PTR DS:[ECX+EAX+120]
00B2C6B2 |. 8955 F0 |MOV DWORD PTR SS:[EBP-10],EDX
00B2C6B5 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C6BB |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C6C1 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C6C7 |. C68401 1F01000>|MOV BYTE PTR DS:[ECX+EAX+11F],0
00B2C6CF |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C6D5 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C6DB |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C6E1 |. C78410 2941000>|MOV DWORD PTR DS:[EAX+EDX+4129],0
00B2C6EC |> 8B4D F0 |MOV ECX,DWORD PTR SS:[EBP-10]
00B2C6EF |. 8B11 |MOV EDX,DWORD PTR DS:[ECX]
00B2C6F1 |. 8955 F4 |MOV DWORD PTR SS:[EBP-C],EDX
00B2C6F4 |. 8B41 04 |MOV EAX,DWORD PTR DS:[ECX+4]
00B2C6F7 |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX
00B2C6FA |. 8A49 08 |MOV CL,BYTE PTR DS:[ECX+8]
00B2C6FD |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
00B2C700 |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2C704 |. 81FA EA130000 |CMP EDX,13EA
00B2C70A |. 7C 4B |JL SHORT XXXXXX.00B2C757
00B2C70C |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2C710 |. 3D EF130000 |CMP EAX,13EF
00B2C715 |. 7F 40 |JG SHORT XXXXXX.00B2C757
00B2C717 |. C685 40FCFFFF >|MOV BYTE PTR SS:[EBP-3C0],0
00B2C71E |. B9 18000000 |MOV ECX,18
00B2C723 |. 33C0 |XOR EAX,EAX
00B2C725 |. 8DBD 41FCFFFF |LEA EDI,DWORD PTR SS:[EBP-3BF]
00B2C72B |. F3:AB |REP STOS DWORD PTR ES:[EDI]
00B2C72D |. 66:AB |STOS WORD PTR ES:[EDI]
00B2C72F |. AA |STOS BYTE PTR ES:[EDI]
00B2C730 |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2C734 |. 51 |PUSH ECX ; /<%d>
00B2C735 |. 68 98E3CE00 |PUSH XXXXXX.00CEE398 ; |format = "Recv Paacket Header %d
"
00B2C73A |. 8D95 40FCFFFF |LEA EDX,DWORD PTR SS:[EBP-3C0] ; |
00B2C740 |. 52 |PUSH EDX ; |s
00B2C741 |. FF15 B8C4BC00 |CALL DWORD PTR DS:[<&MSVCR71.sprintf>] ; \sprintf
00B2C747 |. 83C4 0C |ADD ESP,0C
00B2C74A |. 8D85 40FCFFFF |LEA EAX,DWORD PTR SS:[EBP-3C0]
00B2C750 |. 50 |PUSH EAX ; /String
00B2C751 |. FF15 08C2BC00 |CALL DWORD PTR DS:[<&KERNEL32.OutputDeb>; \OutputDebugStringA
00B2C757 |> 0FB64D F4 |MOVZX ECX,BYTE PTR SS:[EBP-C]
00B2C75B |. 81F9 FB000000 |CMP ECX,0FB
00B2C761 |. 0F85 C4020000 |JNZ XXXXXX.00B2CA2B
00B2C767 |. 66:8B55 F5 |MOV DX,WORD PTR SS:[EBP-B]
00B2C76B |. 66:8995 24FDFF>|MOV WORD PTR SS:[EBP-2DC],DX
00B2C772 |. 0FB785 24FDFFF>|MOVZX EAX,WORD PTR SS:[EBP-2DC]
00B2C779 |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4]
00B2C77F |. 69C9 17400000 |IMUL ECX,ECX,4017
00B2C785 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C78B |. 89840A 2D41000>|MOV DWORD PTR DS:[EDX+ECX+412D],EAX
00B2C792 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2C798 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2C79E |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C7A4 |. C78401 3141000>|MOV DWORD PTR DS:[ECX+EAX+4131],0
00B2C7AF |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C7B5 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C7BB |. 8B45 08 |MOV EAX,DWORD PTR SS:[EBP+8]
00B2C7BE |. 2B85 20FDFFFF |SUB EAX,DWORD PTR SS:[EBP-2E0]
00B2C7C4 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2C7CA |. 398411 2D41000>|CMP DWORD PTR DS:[ECX+EDX+412D],EAX
00B2C7D1 |. 0F87 A6010000 |JA XXXXXX.00B2C97D
00B2C7D7 |. 0FB795 24FDFFF>|MOVZX EDX,WORD PTR SS:[EBP-2DC]
00B2C7DE |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10]
00B2C7E1 |. 8A4C10 FF |MOV CL,BYTE PTR DS:[EAX+EDX-1]
00B2C7E5 |. 888D 3FFCFFFF |MOV BYTE PTR SS:[EBP-3C1],CL
00B2C7EB |. 0FB695 3FFCFFF>|MOVZX EDX,BYTE PTR SS:[EBP-3C1]
00B2C7F2 |. 81FA FE000000 |CMP EDX,0FE
00B2C7F8 |. 74 05 |JE SHORT XXXXXX.00B2C7FF
00B2C7FA |. E9 61060000 |JMP XXXXXX.00B2CE60
00B2C7FF |> 0FB785 24FDFFF>|MOVZX EAX,WORD PTR SS:[EBP-2DC]
00B2C806 |. 8985 18FDFFFF |MOV DWORD PTR SS:[EBP-2E8],EAX
00B2C80C |. 8B8D 18FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E8]
00B2C812 |. 51 |PUSH ECX ; /n
00B2C813 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] ; |
00B2C816 |. 52 |PUSH EDX ; |src
00B2C817 |. 8D85 28FDFFFF |LEA EAX,DWORD PTR SS:[EBP-2D8] ; |
00B2C81D |. 50 |PUSH EAX ; |dest
00B2C81E |. E8 DD31DDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2C823 |. 83C4 0C |ADD ESP,0C
00B2C826 |. 8D8D 28FDFFFF |LEA ECX,DWORD PTR SS:[EBP-2D8]
00B2C82C |. 898D 10FDFFFF |MOV DWORD PTR SS:[EBP-2F0],ECX
00B2C832 |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C838 |. 0FB682 1D01000>|MOVZX EAX,BYTE PTR DS:[EDX+11D]
00B2C83F |. 83F8 01 |CMP EAX,1
00B2C842 |. 75 12 |JNZ SHORT XXXXXX.00B2C856
00B2C844 |. 8B8D 10FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2F0]
00B2C84A |. 51 |PUSH ECX ; /Arg1
00B2C84B |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2C851 |. E8 BA090000 |CALL XXXXXX.00B2D210 ; \XXXXXX.00B2D210
00B2C856 |> 8B95 28FDFFFF |MOV EDX,DWORD PTR SS:[EBP-2D8]
00B2C85C |. 8955 F4 |MOV DWORD PTR SS:[EBP-C],EDX
00B2C85F |. 8B85 2CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2D4]
00B2C865 |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX
00B2C868 |. 8A8D 30FDFFFF |MOV CL,BYTE PTR SS:[EBP-2D0]
00B2C86E |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
00B2C871 |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2C875 |. 81FA EA130000 |CMP EDX,13EA
00B2C87B |. 7C 4B |JL SHORT XXXXXX.00B2C8C8
00B2C87D |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2C881 |. 3D EF130000 |CMP EAX,13EF
00B2C886 |. 7F 40 |JG SHORT XXXXXX.00B2C8C8
00B2C888 |. C685 D0FBFFFF >|MOV BYTE PTR SS:[EBP-430],0
00B2C88F |. B9 18000000 |MOV ECX,18
00B2C894 |. 33C0 |XOR EAX,EAX
00B2C896 |. 8DBD D1FBFFFF |LEA EDI,DWORD PTR SS:[EBP-42F]
00B2C89C |. F3:AB |REP STOS DWORD PTR ES:[EDI]
00B2C89E |. 66:AB |STOS WORD PTR ES:[EDI]
00B2C8A0 |. AA |STOS BYTE PTR ES:[EDI]
00B2C8A1 |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2C8A5 |. 51 |PUSH ECX ; /<%d>
00B2C8A6 |. 68 B0E3CE00 |PUSH XXXXXX.00CEE3B0 ; |format = "Recv Paacket Header %d
"
00B2C8AB |. 8D95 D0FBFFFF |LEA EDX,DWORD PTR SS:[EBP-430] ; |
00B2C8B1 |. 52 |PUSH EDX ; |s
00B2C8B2 |. FF15 B8C4BC00 |CALL DWORD PTR DS:[<&MSVCR71.sprintf>] ; \sprintf
00B2C8B8 |. 83C4 0C |ADD ESP,0C
00B2C8BB |. 8D85 D0FBFFFF |LEA EAX,DWORD PTR SS:[EBP-430]
00B2C8C1 |. 50 |PUSH EAX ; /String
00B2C8C2 |. FF15 08C2BC00 |CALL DWORD PTR DS:[<&KERNEL32.OutputDeb>; \OutputDebugStringA
00B2C8C8 |> 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2C8CC |. 81F9 6F170000 |CMP ECX,176F
00B2C8D2 |. 74 2F |JE SHORT XXXXXX.00B2C903
00B2C8D4 |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2C8D8 |. 81FA 6B170000 |CMP EDX,176B
00B2C8DE |. 74 23 |JE SHORT XXXXXX.00B2C903
00B2C8E0 |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2C8E4 |. 3D 6C170000 |CMP EAX,176C
00B2C8E9 |. 74 18 |JE SHORT XXXXXX.00B2C903
00B2C8EB |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2C8EF |. 81F9 6D170000 |CMP ECX,176D
00B2C8F5 |. 74 0C |JE SHORT XXXXXX.00B2C903
00B2C8F7 |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2C8FB |. 81FA 6E170000 |CMP EDX,176E
00B2C901 |. 75 22 |JNZ SHORT XXXXXX.00B2C925
00B2C903 |> 8B45 10 |MOV EAX,DWORD PTR SS:[EBP+10]
00B2C906 |. 8B48 21 |MOV ECX,DWORD PTR DS:[EAX+21]
00B2C909 |. 51 |PUSH ECX ; /Arg3
00B2C90A |. 66:8B95 18FDFF>|MOV DX,WORD PTR SS:[EBP-2E8] ; |
00B2C911 |. 52 |PUSH EDX ; |Arg2
00B2C912 |. 8D85 28FDFFFF |LEA EAX,DWORD PTR SS:[EBP-2D8] ; |
00B2C918 |. 50 |PUSH EAX ; |Arg1
00B2C919 |. B9 ECB17901 |MOV ECX,XXXXXX.0179B1EC ; |
00B2C91E |. E8 0D0D0000 |CALL XXXXXX.00B2D630 ; \XXXXXX.00B2D630
00B2C923 |. EB 20 |JMP SHORT XXXXXX.00B2C945
00B2C925 |> 8B4D 10 |MOV ECX,DWORD PTR SS:[EBP+10]
00B2C928 |. 8B51 21 |MOV EDX,DWORD PTR DS:[ECX+21]
00B2C92B |. 52 |PUSH EDX ; /Arg3
00B2C92C |. 66:8B85 18FDFF>|MOV AX,WORD PTR SS:[EBP-2E8] ; |
00B2C933 |. 50 |PUSH EAX ; |Arg2
00B2C934 |. 8D8D 28FDFFFF |LEA ECX,DWORD PTR SS:[EBP-2D8] ; |
00B2C93A |. 51 |PUSH ECX ; |Arg1
00B2C93B |. B9 B4B17901 |MOV ECX,XXXXXX.0179B1B4 ; |
00B2C940 |. E8 EB0C0000 |CALL XXXXXX.00B2D630 ; \XXXXXX.00B2D630
00B2C945 |> 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2C94B |. 81C2 14010000 |ADD EDX,114
00B2C951 |. 52 |PUSH EDX ; /pVar
00B2C952 |. FF15 F4C0BC00 |CALL DWORD PTR DS:[<&KERNEL32.Interlock>; \InterlockedIncrement
00B2C958 |. 0FB785 24FDFFF>|MOVZX EAX,WORD PTR SS:[EBP-2DC]
00B2C95F |. 0345 F0 |ADD EAX,DWORD PTR SS:[EBP-10]
00B2C962 |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
00B2C965 |. 0FB78D 24FDFFF>|MOVZX ECX,WORD PTR SS:[EBP-2DC]
00B2C96C |. 038D 20FDFFFF |ADD ECX,DWORD PTR SS:[EBP-2E0]
00B2C972 |. 898D 20FDFFFF |MOV DWORD PTR SS:[EBP-2E0],ECX
00B2C978 |. E9 AC000000 |JMP XXXXXX.00B2CA29
00B2C97D |> 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8]
00B2C980 |. 2B95 20FDFFFF |SUB EDX,DWORD PTR SS:[EBP-2E0]
00B2C986 |. 8995 CCFBFFFF |MOV DWORD PTR SS:[EBP-434],EDX
00B2C98C |. 8B85 CCFBFFFF |MOV EAX,DWORD PTR SS:[EBP-434]
00B2C992 |. 50 |PUSH EAX ; /n
00B2C993 |. 8B4D F0 |MOV ECX,DWORD PTR SS:[EBP-10] ; |
00B2C996 |. 51 |PUSH ECX ; |src
00B2C997 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4] ; |
00B2C99D |. 69D2 17400000 |IMUL EDX,EDX,4017 ; |
00B2C9A3 |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C] ; |
00B2C9A9 |. 8D8C10 2001000>|LEA ECX,DWORD PTR DS:[EAX+EDX+120] ; |
00B2C9B0 |. 51 |PUSH ECX ; |dest
00B2C9B1 |. E8 4A30DDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2C9B6 |. 83C4 0C |ADD ESP,0C
00B2C9B9 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C9BF |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C9C5 |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C9CB |. 8B8C10 3141000>|MOV ECX,DWORD PTR DS:[EAX+EDX+4131]
00B2C9D2 |. 038D CCFBFFFF |ADD ECX,DWORD PTR SS:[EBP-434]
00B2C9D8 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2C9DE |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2C9E4 |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2C9EA |. 898C10 3141000>|MOV DWORD PTR DS:[EAX+EDX+4131],ECX
00B2C9F1 |. 8B4D F0 |MOV ECX,DWORD PTR SS:[EBP-10]
00B2C9F4 |. 038D CCFBFFFF |ADD ECX,DWORD PTR SS:[EBP-434]
00B2C9FA |. 894D F0 |MOV DWORD PTR SS:[EBP-10],ECX
00B2C9FD |. 8B95 20FDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E0]
00B2CA03 |. 0395 CCFBFFFF |ADD EDX,DWORD PTR SS:[EBP-434]
00B2CA09 |. 8995 20FDFFFF |MOV DWORD PTR SS:[EBP-2E0],EDX
00B2CA0F |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2CA15 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2CA1B |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2CA21 |. C68401 1E01000>|MOV BYTE PTR DS:[ECX+EAX+11E],0
00B2CA29 |> EB 17 |JMP SHORT XXXXXX.00B2CA42
00B2CA2B |> 68 C8E3CE00 |PUSH XXXXXX.00CEE3C8 ; /Arg2 = 00CEE3C8 ASCII "Invalide Packet........................!
"
00B2CA30 |. 68 6CF87A01 |PUSH XXXXXX.017AF86C ; |Arg1 = 017AF86C
00B2CA35 |. E8 26E3FFFF |CALL XXXXXX.00B2AD60 ; \XXXXXX.00B2AD60
00B2CA3A |. 83C4 08 |ADD ESP,8
00B2CA3D |. E9 1E040000 |JMP XXXXXX.00B2CE60
00B2CA42 |> E9 14040000 |JMP XXXXXX.00B2CE5B
00B2CA47 |> 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CA4D |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2CA53 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2CA59 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2CA5F |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2CA65 |. 8BB5 F4FAFFFF |MOV ESI,DWORD PTR SS:[EBP-50C]
00B2CA6B |. 8B9411 2D41000>|MOV EDX,DWORD PTR DS:[ECX+EDX+412D]
00B2CA72 |. 2B9406 3141000>|SUB EDX,DWORD PTR DS:[ESI+EAX+4131]
00B2CA79 |. 3B55 08 |CMP EDX,DWORD PTR SS:[EBP+8]
00B2CA7C |. 0F87 4E030000 |JA XXXXXX.00B2CDD0
00B2CA82 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2CA88 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2CA8E |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2CA94 |. 8B9401 2D41000>|MOV EDX,DWORD PTR DS:[ECX+EAX+412D]
00B2CA9B |. 8995 18FDFFFF |MOV DWORD PTR SS:[EBP-2E8],EDX
00B2CAA1 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2CAA7 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2CAAD |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2CAB3 |. 8B9401 3141000>|MOV EDX,DWORD PTR DS:[ECX+EAX+4131]
00B2CABA |. 52 |PUSH EDX ; /n
00B2CABB |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4] ; |
00B2CAC1 |. 69C0 17400000 |IMUL EAX,EAX,4017 ; |
00B2CAC7 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2CACD |. 8D9401 2001000>|LEA EDX,DWORD PTR DS:[ECX+EAX+120] ; |
00B2CAD4 |. 52 |PUSH EDX ; |src
00B2CAD5 |. 8D85 28FDFFFF |LEA EAX,DWORD PTR SS:[EBP-2D8] ; |
00B2CADB |. 50 |PUSH EAX ; |dest
00B2CADC |. E8 1F2FDDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2CAE1 |. 83C4 0C |ADD ESP,0C
00B2CAE4 |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4]
00B2CAEA |. 69C9 17400000 |IMUL ECX,ECX,4017
00B2CAF0 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CAF6 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2CAFC |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2CB02 |. 8BB5 F4FAFFFF |MOV ESI,DWORD PTR SS:[EBP-50C]
00B2CB08 |. 8B8C08 2D41000>|MOV ECX,DWORD PTR DS:[EAX+ECX+412D]
00B2CB0F |. 2B8C16 3141000>|SUB ECX,DWORD PTR DS:[ESI+EDX+4131]
00B2CB16 |. 51 |PUSH ECX ; /n
00B2CB17 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] ; |
00B2CB1A |. 52 |PUSH EDX ; |src
00B2CB1B |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4] ; |
00B2CB21 |. 69C0 17400000 |IMUL EAX,EAX,4017 ; |
00B2CB27 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2CB2D |. 8B9401 3141000>|MOV EDX,DWORD PTR DS:[ECX+EAX+4131] ; |
00B2CB34 |. 8D8415 28FDFFF>|LEA EAX,DWORD PTR SS:[EBP+EDX-2D8] ; |
00B2CB3B |. 50 |PUSH EAX ; |dest
00B2CB3C |. E8 BF2EDDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2CB41 |. 83C4 0C |ADD ESP,0C
00B2CB44 |. 8D8D 28FDFFFF |LEA ECX,DWORD PTR SS:[EBP-2D8]
00B2CB4A |. 898D 10FDFFFF |MOV DWORD PTR SS:[EBP-2F0],ECX
00B2CB50 |. 8B95 28FDFFFF |MOV EDX,DWORD PTR SS:[EBP-2D8]
00B2CB56 |. 8955 F4 |MOV DWORD PTR SS:[EBP-C],EDX
00B2CB59 |. 8B85 2CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2D4]
00B2CB5F |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX
00B2CB62 |. 8A8D 30FDFFFF |MOV CL,BYTE PTR SS:[EBP-2D0]
00B2CB68 |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
00B2CB6B |. 8B95 F4FAFFFF |MOV EDX,DWORD PTR SS:[EBP-50C]
00B2CB71 |. 0FB682 1D01000>|MOVZX EAX,BYTE PTR DS:[EDX+11D]
00B2CB78 |. 83F8 01 |CMP EAX,1
00B2CB7B |. 75 12 |JNZ SHORT XXXXXX.00B2CB8F
00B2CB7D |. 8B8D 10FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2F0]
00B2CB83 |. 51 |PUSH ECX ; /Arg1
00B2CB84 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2CB8A |. E8 81060000 |CALL XXXXXX.00B2D210 ; \XXXXXX.00B2D210
00B2CB8F |> 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2CB93 |. 81FA EA130000 |CMP EDX,13EA
00B2CB99 |. 7C 4B |JL SHORT XXXXXX.00B2CBE6
00B2CB9B |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2CB9F |. 3D EF130000 |CMP EAX,13EF
00B2CBA4 |. 7F 40 |JG SHORT XXXXXX.00B2CBE6
00B2CBA6 |. C685 60FBFFFF >|MOV BYTE PTR SS:[EBP-4A0],0
00B2CBAD |. B9 18000000 |MOV ECX,18
00B2CBB2 |. 33C0 |XOR EAX,EAX
00B2CBB4 |. 8DBD 61FBFFFF |LEA EDI,DWORD PTR SS:[EBP-49F]
00B2CBBA |. F3:AB |REP STOS DWORD PTR ES:[EDI]
00B2CBBC |. 66:AB |STOS WORD PTR ES:[EDI]
00B2CBBE |. AA |STOS BYTE PTR ES:[EDI]
00B2CBBF |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2CBC3 |. 51 |PUSH ECX ; /<%d>
00B2CBC4 |. 68 F4E3CE00 |PUSH XXXXXX.00CEE3F4 ; |format = "Recv Paacket Header %d
"
00B2CBC9 |. 8D95 60FBFFFF |LEA EDX,DWORD PTR SS:[EBP-4A0] ; |
00B2CBCF |. 52 |PUSH EDX ; |s
00B2CBD0 |. FF15 B8C4BC00 |CALL DWORD PTR DS:[<&MSVCR71.sprintf>] ; \sprintf
00B2CBD6 |. 83C4 0C |ADD ESP,0C
00B2CBD9 |. 8D85 60FBFFFF |LEA EAX,DWORD PTR SS:[EBP-4A0]
00B2CBDF |. 50 |PUSH EAX ; /String
00B2CBE0 |. FF15 08C2BC00 |CALL DWORD PTR DS:[<&KERNEL32.OutputDeb>; \OutputDebugStringA
00B2CBE6 |> 0FB74D F5 |MOVZX ECX,WORD PTR SS:[EBP-B]
00B2CBEA |. 8A940D 27FDFFF>|MOV DL,BYTE PTR SS:[EBP+ECX-2D9]
00B2CBF1 |. 8895 CBFBFFFF |MOV BYTE PTR SS:[EBP-435],DL
00B2CBF7 |. 0FB685 CBFBFFF>|MOVZX EAX,BYTE PTR SS:[EBP-435]
00B2CBFE |. 3D FE000000 |CMP EAX,0FE
00B2CC03 |. 74 05 |JE SHORT XXXXXX.00B2CC0A
00B2CC05 |. E9 56020000 |JMP XXXXXX.00B2CE60
00B2CC0A |> 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2CC0E |. 81F9 6F170000 |CMP ECX,176F
00B2CC14 |. 74 2F |JE SHORT XXXXXX.00B2CC45
00B2CC16 |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2CC1A |. 81FA 6B170000 |CMP EDX,176B
00B2CC20 |. 74 23 |JE SHORT XXXXXX.00B2CC45
00B2CC22 |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2CC26 |. 3D 6C170000 |CMP EAX,176C
00B2CC2B |. 74 18 |JE SHORT XXXXXX.00B2CC45
00B2CC2D |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2CC31 |. 81F9 6D170000 |CMP ECX,176D
00B2CC37 |. 74 0C |JE SHORT XXXXXX.00B2CC45
00B2CC39 |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2CC3D |. 81FA 6E170000 |CMP EDX,176E
00B2CC43 |. 75 22 |JNZ SHORT XXXXXX.00B2CC67
00B2CC45 |> 8B45 10 |MOV EAX,DWORD PTR SS:[EBP+10]
00B2CC48 |. 8B48 21 |MOV ECX,DWORD PTR DS:[EAX+21]
00B2CC4B |. 51 |PUSH ECX ; /Arg3
00B2CC4C |. 66:8B95 18FDFF>|MOV DX,WORD PTR SS:[EBP-2E8] ; |
00B2CC53 |. 52 |PUSH EDX ; |Arg2
00B2CC54 |. 8B85 10FDFFFF |MOV EAX,DWORD PTR SS:[EBP-2F0] ; |
00B2CC5A |. 50 |PUSH EAX ; |Arg1
00B2CC5B |. B9 ECB17901 |MOV ECX,XXXXXX.0179B1EC ; |
00B2CC60 |. E8 CB090000 |CALL XXXXXX.00B2D630 ; \XXXXXX.00B2D630
00B2CC65 |. EB 20 |JMP SHORT XXXXXX.00B2CC87
00B2CC67 |> 8B4D 10 |MOV ECX,DWORD PTR SS:[EBP+10]
00B2CC6A |. 8B51 21 |MOV EDX,DWORD PTR DS:[ECX+21]
00B2CC6D |. 52 |PUSH EDX ; /Arg3
00B2CC6E |. 66:8B85 18FDFF>|MOV AX,WORD PTR SS:[EBP-2E8] ; |
00B2CC75 |. 50 |PUSH EAX ; |Arg2
00B2CC76 |. 8B8D 10FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2F0] ; |
00B2CC7C |. 51 |PUSH ECX ; |Arg1
00B2CC7D |. B9 B4B17901 |MOV ECX,XXXXXX.0179B1B4 ; |
00B2CC82 |. E8 A9090000 |CALL XXXXXX.00B2D630 ; \XXXXXX.00B2D630
00B2CC87 |> 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2CC8B |. 81FA DA0F0000 |CMP EDX,0FDA
00B2CC91 |. 74 79 |JE SHORT XXXXXX.00B2CD0C
00B2CC93 |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2CC97 |. 3D AD0F0000 |CMP EAX,0FAD
00B2CC9C |. 74 6E |JE SHORT XXXXXX.00B2CD0C
00B2CC9E |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2CCA2 |. 81F9 AF0F0000 |CMP ECX,0FAF
00B2CCA8 |. 74 62 |JE SHORT XXXXXX.00B2CD0C
00B2CCAA |. 0FB755 FB |MOVZX EDX,WORD PTR SS:[EBP-5]
00B2CCAE |. 81FA B10F0000 |CMP EDX,0FB1
00B2CCB4 |. 74 56 |JE SHORT XXXXXX.00B2CD0C
00B2CCB6 |. 0FB745 FB |MOVZX EAX,WORD PTR SS:[EBP-5]
00B2CCBA |. 3D B30F0000 |CMP EAX,0FB3
00B2CCBF |. 74 4B |JE SHORT XXXXXX.00B2CD0C
00B2CCC1 |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5]
00B2CCC5 |. 81F9 E9030000 |CMP ECX,3E9
00B2CCCB |. 74 3F |JE SHORT XXXXXX.00B2CD0C
00B2CCCD |. C685 F8FAFFFF >|MOV BYTE PTR SS:[EBP-508],0
00B2CCD4 |. B9 18000000 |MOV ECX,18
00B2CCD9 |. 33C0 |XOR EAX,EAX
00B2CCDB |. 8DBD F9FAFFFF |LEA EDI,DWORD PTR SS:[EBP-507]
00B2CCE1 |. F3:AB |REP STOS DWORD PTR ES:[EDI]
00B2CCE3 |. 66:AB |STOS WORD PTR ES:[EDI]
00B2CCE5 |. AA |STOS BYTE PTR ES:[EDI]
00B2CCE6 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CCEC |. 52 |PUSH EDX ; /<%d>
00B2CCED |. 0FB745 F5 |MOVZX EAX,WORD PTR SS:[EBP-B] ; |
00B2CCF1 |. 50 |PUSH EAX ; |<%d>
00B2CCF2 |. 0FB74D FB |MOVZX ECX,WORD PTR SS:[EBP-5] ; |
00B2CCF6 |. 51 |PUSH ECX ; |<%d>
00B2CCF7 |. 68 0CE4CE00 |PUSH XXXXXX.00CEE40C ; |format = "Recv Packet Header Type %d Size %d, SockIndex %d
"
00B2CCFC |. 8D95 F8FAFFFF |LEA EDX,DWORD PTR SS:[EBP-508] ; |
00B2CD02 |. 52 |PUSH EDX ; |s
00B2CD03 |. FF15 B8C4BC00 |CALL DWORD PTR DS:[<&MSVCR71.sprintf>] ; \sprintf
00B2CD09 |. 83C4 14 |ADD ESP,14
00B2CD0C |> 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2CD12 |. 05 14010000 |ADD EAX,114
00B2CD17 |. 50 |PUSH EAX ; /pVar
00B2CD18 |. FF15 F4C0BC00 |CALL DWORD PTR DS:[<&KERNEL32.Interlock>; \InterlockedIncrement
00B2CD1E |. 8B8D 1CFDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E4]
00B2CD24 |. 69C9 17400000 |IMUL ECX,ECX,4017
00B2CD2A |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CD30 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2CD36 |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2CD3C |. 8BB5 F4FAFFFF |MOV ESI,DWORD PTR SS:[EBP-50C]
00B2CD42 |. 8B8C08 2D41000>|MOV ECX,DWORD PTR DS:[EAX+ECX+412D]
00B2CD49 |. 2B8C16 3141000>|SUB ECX,DWORD PTR DS:[ESI+EDX+4131]
00B2CD50 |. 034D F0 |ADD ECX,DWORD PTR SS:[EBP-10]
00B2CD53 |. 894D F0 |MOV DWORD PTR SS:[EBP-10],ECX
00B2CD56 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CD5C |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2CD62 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2CD68 |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2CD6E |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2CD74 |. 8BB5 F4FAFFFF |MOV ESI,DWORD PTR SS:[EBP-50C]
00B2CD7A |. 8B9411 2D41000>|MOV EDX,DWORD PTR DS:[ECX+EDX+412D]
00B2CD81 |. 2B9406 3141000>|SUB EDX,DWORD PTR DS:[ESI+EAX+4131]
00B2CD88 |. 0395 20FDFFFF |ADD EDX,DWORD PTR SS:[EBP-2E0]
00B2CD8E |. 8995 20FDFFFF |MOV DWORD PTR SS:[EBP-2E0],EDX
00B2CD94 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4]
00B2CD9A |. 69C0 17400000 |IMUL EAX,EAX,4017
00B2CDA0 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C]
00B2CDA6 |. C78401 3141000>|MOV DWORD PTR DS:[ECX+EAX+4131],0
00B2CDB1 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CDB7 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2CDBD |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2CDC3 |. C68410 1E01000>|MOV BYTE PTR DS:[EAX+EDX+11E],1
00B2CDCB |. E9 8B000000 |JMP XXXXXX.00B2CE5B
00B2CDD0 |> 8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00B2CDD3 |. 51 |PUSH ECX ; /n
00B2CDD4 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] ; |
00B2CDD7 |. 52 |PUSH EDX ; |src
00B2CDD8 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4] ; |
00B2CDDE |. 69C0 17400000 |IMUL EAX,EAX,4017 ; |
00B2CDE4 |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2CDEA |. 8D9401 1E01000>|LEA EDX,DWORD PTR DS:[ECX+EAX+11E] ; |
00B2CDF1 |. 8B85 1CFDFFFF |MOV EAX,DWORD PTR SS:[EBP-2E4] ; |
00B2CDF7 |. 69C0 17400000 |IMUL EAX,EAX,4017 ; |
00B2CDFD |. 8B8D F4FAFFFF |MOV ECX,DWORD PTR SS:[EBP-50C] ; |
00B2CE03 |. 8B8401 3141000>|MOV EAX,DWORD PTR DS:[ECX+EAX+4131] ; |
00B2CE0A |. 8D4C02 02 |LEA ECX,DWORD PTR DS:[EDX+EAX+2] ; |
00B2CE0E |. 51 |PUSH ECX ; |dest
00B2CE0F |. E8 EC2BDDFF |CALL <JMP.&MSVCR71.memcpy> ; \memcpy
00B2CE14 |. 83C4 0C |ADD ESP,0C
00B2CE17 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CE1D |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2CE23 |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2CE29 |. 8B8C10 3141000>|MOV ECX,DWORD PTR DS:[EAX+EDX+4131]
00B2CE30 |. 034D 08 |ADD ECX,DWORD PTR SS:[EBP+8]
00B2CE33 |. 8B95 1CFDFFFF |MOV EDX,DWORD PTR SS:[EBP-2E4]
00B2CE39 |. 69D2 17400000 |IMUL EDX,EDX,4017
00B2CE3F |. 8B85 F4FAFFFF |MOV EAX,DWORD PTR SS:[EBP-50C]
00B2CE45 |. 898C10 3141000>|MOV DWORD PTR DS:[EAX+EDX+4131],ECX
00B2CE4C |. 8B8D 20FDFFFF |MOV ECX,DWORD PTR SS:[EBP-2E0]
00B2CE52 |. 034D 08 |ADD ECX,DWORD PTR SS:[EBP+8]
00B2CE55 |. 898D 20FDFFFF |MOV DWORD PTR SS:[EBP-2E0],ECX
00B2CE5B |>^E9 61F3FFFF \JMP XXXXXX.00B2C1C1
00B2CE60 |> 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10]
00B2CE63 |. 8B42 1D MOV EAX,DWORD PTR DS:[EDX+1D]
00B2CE66 |. 50 PUSH EAX ; /Arg1
00B2CE67 |. B9 88F87A01 MOV ECX,XXXXXX.017AF888 ; |
00B2CE6C |. E8 9F190000 CALL XXXXXX.00B2E810 ; \XXXXXX.00B2E810
00B2CE71 |. 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]
00B2CE74 |. E8 48EE0500 CALL XXXXXX.00B8BCC1
00B2CE79 |. 5F POP EDI
00B2CE7A |. 5E POP ESI
00B2CE7B |. 8BE5 MOV ESP,EBP
00B2CE7D |. 5D POP EBP
00B2CE7E \. C2 0C00 RETN 0C
Wie geschrieben: Ziemlich groß. Das ist die Funktion, welche Recv-Packets decrypted.
Ich hoffe, dass mir wer helfen kann.
01/09/2010, 04:00
#4
elite*gold: 0
Join Date: Apr 2007
Posts: 2,399
Received Thanks: 6,646
Oh man die ist ja riesig
Aber nebenbei, du wirst daraus nicht wirklich C Code kriegen können.
Alleine wegen die ganzen offsets die benutzt werden etc.
Man könnte das vielleicht einigermaßen in C code verfassen
aber dann auch nur wenn mans selber debuggt und sieht
was er an welchen Addressen macht und was genau
an diesen Addressen ist. Das beste wäre wenn du dir anschaust
was die einzelnen Befehle machen und wenn du das weisst,
kannst du dir beim debuggen anschauen was er genau macht.
So schwer ist das garnicht wenn man schon eine Programmiersprache
einigermaßen beherscht
Beim debuggen würde ich auch mal gucken
wo die Packets die noch nicht entschlüsselt sind liegen und dann
gucken was damit passiert und in der routine beim steppen auf den
Dump achten. Natürlich auch darauf achten ob das Packet noch
irgendwo anders hingepackt wird oder Teile davon etc. Dann musst
du halt drauf achten was benutzt wird um diese zu entschlüsseln.
Wenn du dann weisst womit die Packets entschlüsselt werden,
musst du natürlich noch gucken wo diese Daten herkommen ^^
01/09/2010, 09:28
#5
elite*gold: 0
Join Date: Feb 2009
Posts: 172
Received Thanks: 70
Das habe ich bereits versucht. ;-)
Logisch wäre es wie folgt.
1. Packet erstellen.
2. Packet verschlüsseln.
3. Packet versenden.
... oder ...
1. Packet empfangen.
2. Packet entschlüsseln.
3. Packet parsen.
Ich werde nochmal nachsehen.
EDIT:
Code:
00B2B5D1 |. 8B4D FC ||MOV ECX,DWORD PTR SS:[EBP-4]
00B2B5D4 |. 51 ||PUSH ECX ; /Arg3
00B2B5D5 |. 8B95 10FDFFFF ||MOV EDX,DWORD PTR SS:[EBP-2F0] ; |
00B2B5DB |. 52 ||PUSH EDX ; |Arg2
00B2B5DC |. 8B85 18FDFFFF ||MOV EAX,DWORD PTR SS:[EBP-2E8] ; |
00B2B5E2 |. 50 ||PUSH EAX ; |Arg1
00B2B5E3 |. 8B8D 08FDFFFF ||MOV ECX,DWORD PTR SS:[EBP-2F8] ; |
00B2B5E9 |. E8 620B0000 ||CALL XXXXX.00B2C150
Das ist der Funktionsaufruf direkt nachdem ein Packet empfangen wurde. Wie man sieht beinhaltet ein Packet 3 Parameter.
01/09/2010, 13:18
#6
elite*gold: 15
Join Date: Nov 2005
Posts: 13,021
Received Thanks: 5,324
Wenn du noch ungeübt bist was asm angeht, kannst mit IDA und hex rays den code in C "umwandeln". Ist zwar alles andere als schöner C code aber sinnverstädnlich.
01/09/2010, 14:00
#7
elite*gold: 0
Join Date: Apr 2007
Posts: 2,399
Received Thanks: 6,646
Du kannst auch dem Spiel das verschlüssen
01/09/2010, 15:45
#8
elite*gold: 0
Join Date: Feb 2009
Posts: 172
Received Thanks: 70
Quote:
Originally Posted by
Adroxxx
Wenn du noch ungeübt bist was asm angeht, kannst mit IDA und hex rays den code in C "umwandeln". Ist zwar alles andere als schöner C code aber sinnverstädnlich.
Habe ich bereits getan. ;-) Und wie du schon sagtes: Ist total unschön. :-)
Quote:
Originally Posted by wurstbrot123
Du kannst auch dem Spiel das verschlüssen
Soweit war ich schon. Aber - soweit ich das einschätzen kann - wird bei der Routine PacketParsing das Packet decrypted und direkt verarbeitet. ;-) Und bei Send backtracen habe ich bereits probiert. Jedoch bin ich selbst bei 6, 7, ... Backtraces noch beim encrypted/verschlüsseltem Packet. Versuche ich mehr Backtraces zu machen... stürzt das Spiel auf einmal ab.
01/09/2010, 19:10
#9
elite*gold: 0
Join Date: Feb 2009
Posts: 172
Received Thanks: 70
Ich habe es gefunden.
Aber wie geschrieben: Ich habe nicht viel Ahnung von ASM. Und wenn ich mit Hex-Rays den ASM-Bereich in C umwandeln lasse wird dennoch nicht angezeigt was für Typen (int, float, ...) verwendet wurden.
Aus dem Grund würde ich bitte, mir den folgenden Bereich zu übersetzen. :-)
Code:
00B2A650 /$ 55 PUSH EBP
00B2A651 |. 8BEC MOV EBP,ESP
00B2A653 |. 81EC 34030000 SUB ESP,334
00B2A659 |. A1 C070D900 MOV EAX,DWORD PTR DS:[D970C0]
00B2A65E |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
00B2A661 |. 56 PUSH ESI
00B2A662 |. 57 PUSH EDI
00B2A663 |. 898D CCFCFFFF MOV DWORD PTR SS:[EBP-334],ECX
00B2A669 |. C685 30FDFFFF >MOV BYTE PTR SS:[EBP-2D0],0
00B2A670 |. B9 AE000000 MOV ECX,0AE
00B2A675 |. 33C0 XOR EAX,EAX
00B2A677 |. 8DBD 31FDFFFF LEA EDI,DWORD PTR SS:[EBP-2CF]
00B2A67D |. F3:AB REP STOS DWORD PTR ES:[EDI]
00B2A67F |. 66:AB STOS WORD PTR ES:[EDI]
00B2A681 |. AA STOS BYTE PTR ES:[EDI]
00B2A682 |. 8D85 30FDFFFF LEA EAX,DWORD PTR SS:[EBP-2D0]
00B2A688 |. 8985 2CFDFFFF MOV DWORD PTR SS:[EBP-2D4],EAX
00B2A68E |. C685 2BFDFFFF >MOV BYTE PTR SS:[EBP-2D5],0FE
00B2A695 |. 0FBF4D 14 MOVSX ECX,WORD PTR SS:[EBP+14]
00B2A699 |. 51 PUSH ECX ; /Arg3
00B2A69A |. 68 28E0CE00 PUSH XXXXX.00CEE028 ; |Arg2 = 00CEE028 ASCII "PACKET_==>> : %d"
00B2A69F |. 6A 01 PUSH 1 ; |Arg1 = 00000001
00B2A6A1 |. E8 1AAE8DFF CALL XXXXX.004054C0 ; \XXXXX.004054C0
01/10/2010, 09:38
#10
elite*gold: 0
Join Date: Apr 2007
Posts: 2,399
Received Thanks: 6,646
Code:
PUSH EBP --> pusht den inhalt von EBP oben auf den system Stack
MOV EBP, ESP --> plaziert den inhalt von ESP in EBP
SUB ESP, 334 --> zieht 0x334 von ESP ab und speichert das ergebnis in ESP
MOV EAX,DWORD PTR DS:[D970C0] --> lädt den DWORD an Addresse 0xD970C0 in EAX
MOV DWORD PTR SS:[EBP-10],EAX --> Der Wert der in EAX ist,
wird an der Addresse EBP-0x10 geschrieben
PUSH ESI --> pusht den inhalt von EBP oben auf den system Stack
PUSH EDI --> pusht den inhalt von EBP oben auf den system Stack
MOV DWORD PTR SS:[EBP-334],ECX --> Der Wert der in ECX ist,
wird an der Addresse EBP-0x334 geschrieben
MOV BYTE PTR SS:[EBP-2D0],0 setzt das BYTE an Addresse EBP-0x2D0
auf 0
XOR EAX,EAX --> Setzt EAX auf 0
LEA EDI,DWORD PTR SS:[EBP-2CF] --> Lädt die Addresse EBP - 0x2CF
in EDI ( edi = ebp - 0x2CF )
REP STOS DWORD PTR ES:[EDI] // setzt die bytes an der Addresse die in
EDI ist auf 0
STOS WORD PTR ES:[EDI]
STOS BYTE PTR ES:[EDI]
LEA EAX,DWORD PTR SS:[EBP-2D0] --> Lädt die Addresse
EBP-0x2D0 in EDI
MOV DWORD PTR SS:[EBP-2D4],EAX --> Der Wert der in EAX ist,
wird an der Addresse EBP-0x2D4 geschrieben
MOV BYTE PTR SS:[EBP-2D5],0FE --> Schreibt 0xFE an der Addresse
EBP-0x2D5
MOVSX ECX,WORD PTR SS:[EBP+14] --> lädt 2 bytes von der Addresse
EBP+0x14 in ECX
PUSH ECX --> Siehe weiter oben
PUSH XXXXX.00CEE028 --> Siehe weiter oben
PUSH 1 --> Siehe weiter oben
CALL XXXXX.004054C0 // Funktion, Funktionen nehmen ihre Parameter
ganz oben vom system stack, das heisst die Argumente sind
void function( 1, 0x00CEE028, ECX (bzw der wert der in ECX ist ^^) )
Die Register
EAX ECX EDX EBX ESP EBP ESI und EDI sind 4 Bytes groß (ein DWORD ^^)
und die Werte bzw Addressen die du dann in olly siehst sind in HEX
So hab dir mal erklärt was die einzelnen Befehle dort machen.
Um zu wissen was dort genau passiert, musst du dir das
beim Steppen angucken und sehen was an den Addressen steht ^^
Metin2 suche nach Pickup-"Hack"
09/04/2010 - Metin2 - 8 Replies
Die sache is folgende:
Bis vor ner weile hatte ich mal 'n multihack glaub von Gexx, bei welchem eine Pickup-bot funktion eingebaut war. Diese war aber kein 08/15 Pickup-Bot der Pausenlos "y" oder "^" drückt, sondern dieser hatt ALLES!!! YANG UND GEGENSTÄNDE! innerhalb einer Millisekunde auf gepickt. da ich aber kein bock hab ständig den hack zu starten, und ausserdem funzt der inzwischen eh nichmehr, was aber irrelevant is da ich nurnoch Pserver spiel... esseidenn... nää, Yoar, drum will ich...
Suche nach dem "Metin in der Stadt" Thread
03/30/2010 - Metin2 Private Server - 5 Replies
Servus ich habe vorhin einen Thread mit dem namen:
Metinsteine in der stadt
gesehn in dem downloads waren , womit die metins in einer reihe in den map1 s gespawnt sind , sufu nix gefunden , der thread scheint wie vom erdboden verschlungen kann mri jemand den link geben gebe thx
[Suche AutoIt "Profi"] Nostale 2x Botten!
01/08/2009 - Nostale - 5 Replies
Da ich nirgends eine Antwort finden konnte, öffne ich einen neuen Thread.
Worum geht es: Nun, ich habe durch ein Programm die Möglichkeit, Windows umzubenennen. Somit könnte ich den RedBot 2x benutzen, wenn ich ihm sagen würde, starte den Bot, wenn das Fenster "soundso" heißt. Ich selbst habe mich bislang nur mit VB 2008 beschäftigt und habe mit AutoIt daher nichts voran gebracht... Also suche ich jemanden, der mir den Bot editieren kann. Kann ja nicht schwer sein. xD Schreiben konnte ihn...
All times are GMT +2. The time now is 04:46 .
Beim debuggen würde ich auch mal gucken
