@Rings: Das ist aber ganz stark OT und ich möchte nicht als böser Hacker dastehen, aber sei es drum (kann ja von euch gelöscht werden). Nehmen wir gleich mal das erste Call vom Macro, SYS_CopyString. Dieser Aufruf macht nichts weiter als a$="do_something_" zu setzen. So sieht der ASM-Code aus; und strlen habe ich noch aussen vor gelassen:
Code: Alles auswählen
Call SYS_CopyString, setzt a$ = "do_something_"
$000000014000107E E8 9D 11 00 00 CALL 00 00 00 01 40 00 22 20
$0000000140002220 48 89 4C 24 08 MOV qword ptr [ RSP + 08 ] , RCX
$0000000140002225 48 83 EC 38 SUB RSP , 00 00 00 00 00 00 00 38
$0000000140002229 48 83 7C 24 40 00 CMP qword ptr [ RSP + 40 ] , 00 00 00 00 00 00 00 00
$000000014000222F 74 38 JE 00 00 00 01 40 00 22 69 ( short ) ( = JZ )
$0000000140002231 48 8B 4C 24 40 MOV RCX , qword ptr [ RSP + 40 ]
$0000000140002236 E8 58 02 00 00 CALL 00 00 00 01 40 00 24 93
$000000014000223B 89 44 24 28 MOV dword ptr [ RSP + 28 ] , EAX
$000000014000223F 8B 15 AB 2F 00 00 MOV EDX , dword ptr [ 00 00 00 01 40 00 51 F0 ]
$0000000140002245 8B 4C 24 28 MOV ECX , dword ptr [ RSP + 28 ]
$0000000140002249 E8 02 01 00 00 CALL 00 00 00 01 40 00 23 50
$000000014000224E 48 89 44 24 20 MOV qword ptr [ RSP + 20 ] , RAX
$0000000140002253 44 8B 44 24 28 MOV R8D , dword ptr [ RSP + 28 ]
$0000000140002258 48 8B 54 24 40 MOV RDX , qword ptr [ RSP + 40 ]
$000000014000225D 48 8B 4C 24 20 MOV RCX , qword ptr [ RSP + 20 ]
$0000000140002262 E8 B9 01 00 00 CALL 00 00 00 01 40 00 24 20
$0000000140002267 EB 17 JMP 00 00 00 01 40 00 22 80 ( short )
$0000000140002269 48 8B 05 80 2F 00 00 MOV RAX , qword ptr [ 00 00 00 01 40 00 51 F0 ]
$0000000140002270 48 8B 0D 89 2F 00 00 MOV RCX , qword ptr [ 00 00 00 01 40 00 52 00 ]
$0000000140002277 48 03 C8 ADD RCX , RAX
$000000014000227A 48 8B C1 MOV RAX , RCX
$000000014000227D C6 00 00 MOV byte ptr [ RAX ] , 00
$0000000140002280 48 83 C4 38 ADD RSP , 00 00 00 00 00 00 00 38
$0000000140002284 C3 RET (near)
$0000000140002493 strlen
$0000000140002350 89 54 24 10 MOV dword ptr [ RSP + 10 ] , EDX
$0000000140002354 89 4C 24 08 MOV dword ptr [ RSP + 08 ] , ECX
$0000000140002358 48 83 EC 38 SUB RSP , 00 00 00 00 00 00 00 38
$000000014000235C 48 63 44 24 40 MOVSXD RAX , dword ptr [ RSP + 40 ]
$0000000140002361 48 8B 0D 88 2E 00 00 MOV RCX , qword ptr [ 00 00 00 01 40 00 51 F0 ]
$0000000140002368 48 03 C8 ADD RCX , RAX
$000000014000236B 48 8B C1 MOV RAX , RCX
$000000014000236E 89 44 24 28 MOV dword ptr [ RSP + 28 ] , EAX
$0000000140002372 48 63 44 24 28 MOVSXD RAX , dword ptr [ RSP + 28 ]
$0000000140002377 48 8B 0D A2 2E 00 00 MOV RCX , qword ptr [ 00 00 00 01 40 00 52 20 ]
$000000014000237E 48 83 E9 04 SUB RCX , 00 00 00 00 00 00 00 04
$0000000140002382 48 3B C1 CMP RAX , RCX
$0000000140002385 7C 3D JL 00 00 00 01 40 00 23 C4 ( short ) ( = JNGE )
$0000000140002387 8B 44 24 28 MOV EAX , dword ptr [ RSP + 28 ]
$000000014000238B 05 00 40 00 00 ADD EAX , 00 00 40 00
$0000000140002390 48 98 CDQE
$0000000140002392 48 89 05 87 2E 00 00 MOV qword ptr [ 00 00 00 01 40 00 52 20 ] , RAX
$0000000140002399 48 8B 05 80 2E 00 00 MOV RAX , qword ptr [ 00 00 00 01 40 00 52 20 ]
$00000001400023A0 48 83 C0 05 ADD RAX , 00 00 00 00 00 00 00 05
$00000001400023A4 4C 8B C8 MOV R9 , RAX
$00000001400023A7 4C 8B 05 52 2E 00 00 MOV R8 , qword ptr [ 00 00 00 01 40 00 52 00 ]
$00000001400023AE 33 D2 XOr EDX , EDX
$00000001400023B0 48 8B 0D 59 2E 00 00 MOV RCX , qword ptr [ 00 00 00 01 40 00 52 10 ]
$00000001400023B7 FF 15 5F 2D 00 00 CALL qword ptr [ 00 00 00 01 40 00 51 1C ] ("HeapReAlloc") ( near )
$00000001400023BD 48 89 05 3C 2E 00 00 MOV qword ptr [ 00 00 00 01 40 00 52 00 ] , RAX
$00000001400023C4 48 63 44 24 48 MOVSXD RAX , dword ptr [ RSP + 48 ]
$00000001400023C9 48 8B 0D 30 2E 00 00 MOV RCX , qword ptr [ 00 00 00 01 40 00 52 00 ]
$00000001400023D0 48 03 C8 ADD RCX , RAX
$00000001400023D3 48 8B C1 MOV RAX , RCX
$00000001400023D6 48 89 44 24 20 MOV qword ptr [ RSP + 20 ] , RAX
$00000001400023DB 48 63 44 24 48 MOVSXD RAX , dword ptr [ RSP + 48 ]
$00000001400023E0 48 63 4C 24 40 MOVSXD RCX , dword ptr [ RSP + 40 ]
$00000001400023E5 48 03 C1 ADD RAX , RCX
$00000001400023E8 48 89 05 01 2E 00 00 MOV qword ptr [ 00 00 00 01 40 00 51 F0 ] , RAX
$00000001400023EF 48 8B 44 24 20 MOV RAX , qword ptr [ RSP + 20 ]
$00000001400023F4 48 83 C4 38 ADD RSP , 00 00 00 00 00 00 00 38
$00000001400023F8 C3 RET (near)
$0000000140002420 44 89 44 24 18 MOV dword ptr [ RSP + 18 ] , R8D
$0000000140002425 48 89 54 24 10 MOV qword ptr [ RSP + 10 ] , RDX
$000000014000242A 48 89 4C 24 08 MOV qword ptr [ RSP + 08 ] , RCX
$000000014000242F 48 83 EC 18 SUB RSP , 00 00 00 00 00 00 00 18
$0000000140002433 48 63 44 24 30 MOVSXD RAX , dword ptr [ RSP + 30 ]
$0000000140002438 48 8B 4C 24 20 MOV RCX , qword ptr [ RSP + 20 ]
$000000014000243D 48 03 C8 ADD RCX , RAX
$0000000140002440 48 8B C1 MOV RAX , RCX
$0000000140002443 48 89 04 24 MOV qword ptr [ RSP ] , RAX
$0000000140002447 83 7C 24 30 00 CMP dword ptr [ RSP + 30 ] , 00 00 00 00
$000000014000244C 7E 39 JLE 00 00 00 01 40 00 24 87 ( short ) ( = JNG )
$000000014000244E 48 8B 44 24 20 MOV RAX , qword ptr [ RSP + 20 ]
$0000000140002453 48 8B 4C 24 28 MOV RCX , qword ptr [ RSP + 28 ]
$0000000140002458 8B 09 MOV ECX , dword ptr [ RCX ]
$000000014000245A 89 08 MOV dword ptr [ RAX ] , ECX
$000000014000245C 48 8B 44 24 20 MOV RAX , qword ptr [ RSP + 20 ]
$0000000140002461 48 83 C0 04 ADD RAX , 00 00 00 00 00 00 00 04
$0000000140002465 48 89 44 24 20 MOV qword ptr [ RSP + 20 ] , RAX
$000000014000246A 48 8B 44 24 28 MOV RAX , qword ptr [ RSP + 28 ]
$000000014000246F 48 83 C0 04 ADD RAX , 00 00 00 00 00 00 00 04
$0000000140002473 48 89 44 24 28 MOV qword ptr [ RSP + 28 ] , RAX
$0000000140002478 48 63 44 24 30 MOVSXD RAX , dword ptr [ RSP + 30 ]
$000000014000247D 48 83 E8 04 SUB RAX , 00 00 00 00 00 00 00 04
$0000000140002481 89 44 24 30 MOV dword ptr [ RSP + 30 ] , EAX
$0000000140002485 EB C0 JMP 00 00 00 01 40 00 24 47 ( short )
$0000000140002487 48 8B 04 24 MOV RAX , qword ptr [ RSP ]
$000000014000248B C6 00 00 MOV byte ptr [ RAX ] , 00
$000000014000248E 48 83 C4 18 ADD RSP , 00 00 00 00 00 00 00 18
$0000000140002492 C3 RET (near)