W32DASM一個靜態調試工具
代碼段:W32DASM:查看匯編代碼 if被MASM編譯器編譯成CMP和jne?.code start:invoke MessageBox,NULL,offset messageS,offset titleS,MB_YESNO.if eax == 6invoke MessageBox,NULL,offset msgOk,offset tipS,MB_OK.elseinvoke MessageBox,NULL,offset msgNo,offset tipS,MB_OK.endifinvoke ExitProcess,NULLend start
//******************** Program Entry Point ******** :00401000 6A04 ? ? ? ? ? ? ? ? ? ?push 00000004 :00401002 6800304000 ? ? ? ? ? ? ?push 00403000* Possible StringData Ref from Data Obj ->"hello,welcome to win32"| :00401007 680B304000 ? ? ? ? ? ? ?push 0040300B :0040100C 6A00 ? ? ? ? ? ? ? ? ? ?push 00000000* Reference To: user32.MessageBoxA, Ord:01B1h| :0040100E E835000000 ? ? ? ? ? ? ?Call 00401048 :00401013 83F806 ? ? ? ? ? ? ? ? ?cmp eax, 00000006 ;*****************************if :00401016 7515 ? ? ? ? ? ? ? ? ? ?jne 0040102D :00401018 6A00 ? ? ? ? ? ? ? ? ? ?push 00000000* Possible StringData Ref from Data Obj ->"TIPS"| :0040101A 6822304000 ? ? ? ? ? ? ?push 00403022* Possible StringData Ref from Data Obj ->"click YES"| :0040101F 6827304000 ? ? ? ? ? ? ?push 00403027 :00401024 6A00 ? ? ? ? ? ? ? ? ? ?push 00000000* Reference To: user32.MessageBoxA, Ord:01B1h| :00401026 E81D000000 ? ? ? ? ? ? ?Call 00401048 :0040102B EB13 ? ? ? ? ? ? ? ? ? ?jmp 00401040 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00401016(C) | :0040102D 6A00 ? ? ? ? ? ? ? ? ? ?push 00000000* Possible StringData Ref from Data Obj ->"TIPS"| :0040102F 6822304000 ? ? ? ? ? ? ?push 00403022* Possible StringData Ref from Data Obj ->"click NO"| :00401034 6831304000 ? ? ? ? ? ? ?push 00403031 :00401039 6A00 ? ? ? ? ? ? ? ? ? ?push 00000000* Reference To: user32.MessageBoxA, Ord:01B1h| :0040103B E808000000 ? ? ? ? ? ? ?Call 00401048* Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040102B(U) | :00401040 6A00 ? ? ? ? ? ? ? ? ? ?push 00000000* Reference To: kernel32.ExitProcess, Ord:009Bh| :00401042 E807000000 ? ? ? ? ? ? ?Call 0040104E :00401047 CC ? ? ? ? ? ? ? ? ? ? ?int 03* Referenced by a CALL at Addresses: |:0040100E ? , :00401026 ? , :0040103B ?? |* Reference To: user32.MessageBoxA, Ord:01B1h| :00401048 FF2508204000 ? ? ? ? ? ?Jmp dword ptr [00402008]* Reference To: kernel32.ExitProcess, Ord:009Bh| :0040104E FF2500204000 ? ? ? ? ? ?Jmp dword ptr [00402000]