, . : . - . ("generic"), .
" " . , , , .
. , GetMessageA 0, 12h (WM_QUIT), . 12h PostQuitMessage ( User32.dll), - ( 0). - 2 (WM_DESTROY). ( , ; ExitProcess. , , , "" , ).
, rdata.txt DefWindowProc, - PostQuitMessage. . ; , "" , ( ). 400h ( - 1000h - ). ".rsrc" - ( PE-). .., : (400h , 1000h ), ".code" 1000h 400h , ".rdata" (2000h 800h), ".data" (3000h C00h), (4000h 1000h).
"rdata.txt" :
n rdata.bin
r cx
f 2000 l 400 0
a 2000
; 1- IAT ( Kernel32.dll)
; GetModuleHandleA
db f0 21 0 0
; ExitProcess
db 4 22 0 0
db 0 0 0 0
; 2- IAT (User32.dll)
; CreateWindowExA
db 12 22 0 0
; GetMessageA
db 24 22 0 0
; DispatchMessageA
db 32 22 0 0
; TranslateMessage
db 46 22 0 0
; DefWindowProc
db 5a 22 0 0
; RegisterClassExA
db 6c 22 0 0
; PostQuitMessage
db 80 22 0 0
db 0 0 0 0
a 2088
; Kernel32.dll
|
|
|
; GetModuleHandleA
db f0 21 0 0
; ExitProcess
db 4 22 0 0
db 0 0 0 0
; User32.dll
; CreateWindowExA
db 12 22 0 0
; GetMessageA
db 24 22 0 0
; DispatchMessageA
db 32 22 0 0
; TranslateMessage
db 46 22 0 0
; DefWindowProcA
db 5a 22 0 0
; RegisterClassExA
db 6c 22 0 0
; PostQuitMessage
db 80 22 0 0
db 0 0 0 0
a 2110
; : 2 + (0)
; Kernel32.dll
;
db 88 20 0 0
db 0 0 0 0 0 0 0 0
; "Kernel32.dll"
db a0 21 0 0
; IAT(1)
db 0 20 0 0
; User32.dll
;
db 94 20 0 0
db 0 0 0 0 0 0 0 0
; "User32.dll"
db ad 21 0 0
; IAT(2)
db 0C 20 0 0
;
a 21a0
;
db "Kernel32.dll" 0
db "User32.dll" 0
a 21f0
;
db 0 0 "GetModuleHandleA" 0 0
db 0 0 "ExitProcess" 0
db 0 0 "CreateWindowExA" 0
db 0 0 "GetMessageA" 0
db 0 0 "DispatchMessageA" 0 0
db 0 0 "TranslateMessage" 0 0
db 0 0 "DefWindowProcA" 0 0
db 0 0 "RegisterClassExA" 0 0
db 0 0 "PostQuitMessage" 0
m 2000 l 400 100
w
q
. 400h. IAT ; ; , . .
PE-. , "header.txt" ( 4), (5000h) (400h), . "header.txt" 400h. :
n Header.bin
r cx
f 0 l 400 0
e 0 'MZ'
e 3C 40
e 40 'PE'
e 44 4C 01
a 46
;
db 04 00
a 54
;
db e0 00
;
db 0F 01
; ""
db 0B 01
a 68
;
;
db 00 10 00 00
a 74
;
db 00 00 40 00
;
db 00 10 00 00
;
db 00 02 00 00
; Windows
db 04 00
a 88
;
db 04 00
a 90
;
db 00 50 00 00
;
db 00 04 00 00
a 9C
; : 2 - , 03 -
db 02 00
a A0
;
db 00 00 10 00
;
db 00 10 00 00
;
db 00 00 10 00
;
db 00 10 00 00
a B4
;
db 10 00 00 00
;
; /
;
db 0 0 0 0
;
db 0 0 0 0
;
db 10 21 0 0
;
|
|
|
db 3c 0 0 0
;
; db 0 0 0 0
;
; db 0 0 0 0
a 138
;
;
; ( - 8 )
db '.code' 0 0 0
;
db 0 4 0 0
;
db 0 10 0 0
;
db 0 4 0 0
;
db 0 4 0 0
; 12
db 0 0 0 0 0 0 0 0 0 0 0 0
;
db 20 0 0 60
;
;
db '.rdata' 0 0
;
db 0 4 0 0
;
db 0 20 0 0
;
db 0 4 0 0
;
db 0 8 0 0
db 0 0 0 0 0 0 0 0 0 0 0 0
;
db 40 0 0 40
;
;
db '.data' 0 0 0
;
db 0 4 0 0
;
db 0 30 0 0
;
db 0 4 0 0
;
db 0 c 0 0
db 0 0 0 0 0 0 0 0 0 0 0 0
;
db 40 0 0 C0
;
;
db '.rsrc' 0 0 0
;
db 0 4 0 0
;
db 0 40 0 0
;
db 0 4 0 0
;
db 0 10 0 0
db 0 0 0 0 0 0 0 0 0 0 0 0
;
db 40 0 0 c0
m 0 l 400 100
w
q
"code.txt" . ( 400h). "" debug "" (1000h), .
n code.bin
r cx
f 1000 l 400 0
a 1000
; GetModuleHandleA = 0
db 6a 0
; GetModuleHandleA ( IAT(1) 402000h)
db ff 15 0 20 40 0
; EAX 403054h
db a3 54 30 40 0
; RegisterClassExA -
; WNDCLASSEX (403040h)
db 68 40 30 40 0
; RegisterClassExA ( IAT(2) - 402020h)
db ff 15 20 20 40 0
; CreateWindowExA
; (0)
db 6a 0
; ( 403054h)
db ff 35 54 30 40 0
; (0)
db 6a 0
; - (0)
db 6a 0
;
db 68 0 1 0 0
;
db 68 50 1 0 0
; y
db 68 0 1 0 0
; x
db 68 50 1 0 0
;
db 68 0 0 cf 10
; ( - 403010h)
db 68 10 30 40 0
; ( - 403000h)
db 68 0 30 40 0
; (0)
db 6a 0
; CreateWindowExA ( IAT(2) 40200Ch)
db ff 15 c 20 40 0
;
; GetMessageA
db 6a 0
db 6a 0
db 6a 0
; 4- - MSG ( - 403020h)
db 68 20 30 40 0
; GetMessageA ( IAT(2) 402010h)
db ff 15 10 20 40 0
GetMessageA . EAX 0, TranslateMessage DispatchMessageA . 0, ExitProcess. 100000sw Mod111R/M; , ( , 0). EAX, w = 1; - 4 , s 1. (Mod = 11), EAX - 000. :
10000011 11111000 00000000, 83 F8 00 (h)
:
; EAX = 0?
db 83 f8 00
; - 18h
db 74 18
; TranslateMessage - MSG (403020h)
db 68 20 30 40 0
; TranslateMessage ( IAT(2) 402018h)
db ff 15 18 20 40 0
; DispatchMessageA - MSG (403020h)
db 68 20 30 40 0
; DispatchMessageA ( IAT(2) 402014h)
db ff 15 14 20 40 0
; "" (-46 )
|
|
|
db eb d2
ExitProcess. 0; WM_QUIT, wParam MSG ( , PostQuitMessage). ExitProcess . , ; ModR/M. " "; :
11111111 Mod 110 R/M
Mod = 00 R/M = 101, 4 . MSG 403020h, wParam - 403028h:
; ExitProcess ( = MSG.wParam)
db ff 35 28 30 40 0
; ExitProcess ( IAT(1) 402004h)
db ff 15 4 20 40 0
. , , :
;-----------------------
;
; :
db 55
db 89 e5
, . (DefWindowProc) , 2. , (.. ). , PostQuitMessage 0 . , :
; [EBP+0Ch] 2
db 83 7d c 2
; = 0Ch ( " ")
db 75 c
; PostQuitMessage (0)
db 6a 0
; PostQuitMessage
db ff 15 24 20 40 0
; ""
;
db c9
;
db c2 10 0
; " "
. DefWindowProc ( , ) . ( ), EBP; . , 1 ( Mod 01). R/M EBP - 101, :
11111111 01110101 <1 > (FFh 75h <...>)
, . EBP (14h), 10h, 0Ch 8:
; DefWindowProc
db ff 75 14
db ff 75 10
db ff 75 c
db ff 75 8
; DefWindowProc
db ff 15 1c 20 40 0
- . ; :
; "" - -24
db eb e8
m 1000 l 400 100
w
q
. "data.txt". , , - WNDCLASSEX:
n data.bin
r cx
f 3000 l 400 0
a 3000
;
db "MYCLASS" 0
a 3010
;
db " " 0
a 3020
; MSG (28 )
a 3040
; WNDCLASSEX:
;
db 30 0 0 0
|
|
|
;
db 0 0 0 0
; (403048h)
db 89 10 40 0
;
db 0 0 0 0
;
db 0 0 0 0
; (403054h)
db 0 0 0 0
;
db 0 0 0 0
;
db 0 0 0 0
;
db 6 0 0 0
;
db 0 0 0 0
;
db 0 30 40 0
;
db 0 0 0 0
m 3000 l 400 100
w
q
- ( rsrc.txt):
n rsrc.bin
r cx
f 4000 l 400 0
m 4000 l 400 100
w
q
(make.bat):
@echo off
debug < header.txt > report.lst
debug < code.txt >> report.lst
debug < rdata.txt >> report.lst
debug < data.txt >> report.lst
debug < rsrc.txt >> report.lst
copy /b header.bin+code.bin+rdata.bin+data.bin+rsrc.bin generic.exe
"generic.exe" copy - . . "report.lst"; , . Win32, , . . - !
