作者: luckiejacky 時間: 2016-8-24 20:56 標題: IDA Pro 分析 某些Basic Block時有overlap region?
用這條script 分析會出現以下結果
- USE32
- section .text
- global _?_PropagateMessage@CTray@@IAEXPAUHWND__@@IIJ@Z
- _?_PropagateMessage@CTray@@IAEXPAUHWND__@@IIJ@Z:
- push ebp
- mov ebp, esp
- sub esp, 10h
- mov eax, [ebp+0Ch]
- mov [ebp-10h], eax
- mov eax, [ebp+10h]
- mov [ebp-0Ch], eax
- mov eax, [ebp+14h]
- mov [ebp-8], eax
- lea eax,[ebp-10h]
- push eax
- push ?PropagateEnumProc@CTray@@KGHPAUHWND__@@J@Z
- push dword [ebp+8]
- mov [ebp-4], ecx
- call dword [__imp__EnumChildWindows@12]
- leave
- retn 10h
- ?PropagateEnumProc@CTray@@KGHPAUHWND__@@J@Z:
- push esi
- push dword [esp+8]
- mov esi, [esp+10h]
- mov eax, [esi+0Ch]
- push dword [eax+450h]
- call dword [__imp__SHIsChildOrSelf@8]
- test eax,eax
- jz loc_10199B7
- push dword [esi+8]
- push dword [esi+4]
- push dword [esi]
- push dword [esp+14h]
- call dword [__imp__SendMessageW@16]
- loc_10199B7:
- xor eax, eax
- inc eax
- pop esi
- retn 8
不是下一個function/Basic Block嗎?
有冇CHING知?
THX
- seg = FirstSeg();
-
- while(seg != BADADDR)
- {
- start = SegStart(seg);
-
- for (addr = NextFunction(start); addr != BADADDR; addr = NextFunction(addr)) {
- name = Name(addr);
- end = GetFunctionAttr(addr, FUNCATTR_END);
- Message("%s:\n", name);
- DumpFunction(name, addr, end);
- }
-
- seg = NextSeg(seg);
- }