20130923 어셈블리어 수업 (레지스터값들 변수에 넣기)

 

 

context 프로그램 만들기

smart0923.asm .386 .MODEL FLAT   .STACK 4096   PUBLIC _SMART EXTRN _LINUX:NEAR32 ExitProcess PROTO NEAR32 stdcall, dwExitCode:DWORD   .DATA _EFL     DWORD    0h _EIP      DWORD    0h _EDI      DWORD    0h _ESI      DWORD    0h _EBP     DWORD    0h _ESP     DWORD    0h _EBX     DWORD    0h _EDX     DWORD    0h _ECX     DWORD    0h _EAX     DWORD    0h   .CODE _SMART:                  LEA          EAX, _EFL               ; EBX = &_EFL                  PUSH        EAX                  MOV         EAX, 0                  CALL        _LINUX                   ADD          ESP, 4                  INVOKE     ExitProcess, 0   END            linux0923.asm .386 .MODEL FLAT   PUBLIC _LINUX   .CODE _LINUX       PROC      NEAR32                    PUSH      EBP                    MOV       EBP, ESP                      PUSHFD                                 ; EFL 임시저장                        MOV EAX, [EBP-4]                 ; EFL이 변형되기 때문에                     AND EAX, 0FFFFFEFFH            ; TF(Trap Flag) 제거                    MOV [EBP-4], EAX    MOV ESP, [EBP+8]                 ; ESP _EAX위치로 이동  ADD ESP, 40  PUSH EAX                              ; 레지스터 값들 PUSH  PUSH ECX  PUSH EDX  PUSH EBX    MOV  EAX, EBP                      ; OLD ESP     ADD   EAX, 8                   PUSH EAX        PUSH [EBP]                          ; OLD EBP  PUSH ESI  PUSH EDI  PUSH [EBP+4]                       ; EIP  PUSH [EBP-4]                       ; EFL  ;MOV ESP, EBP  ;SUB ESP, 4  ;POPFD   MOV ESP, EBP POP EBP RET   _LINUX        ENDP END    PUSHAD를 이용 (linux.asm) .386 .MODEL FLAT   PUBLIC _LINUX   .CODE _LINUX    PROC  NEAR32     PUSH        EBP   MOV         EBP, ESP   PUSHFD                                     ; EFL 임시저장        MOV         EAX, [EBP-4]         ; EFL이 변형되기 때문에    AND          EAX, 0FFFFFEFFH    ; TF(Trap Flag) 제거   MOV         [EBP-4], EAX      MOV         ESP, [EBP+8]         ; ESP를 _EAX 위치로 이동   ADD          ESP,  40   PUSHAD                         ; 레지스터 값들 push   PUSH      [EBP+4]           ; push EIP(return address)   PUSH      [EBP-4]           ; push EFL       ADD        ESP,  24          ; _ESP  위치로 가서    MOV       EAX, EBP    ADD        EAX, 8            ; EBP로 부터 ESP를 찾아서      PUSH      EAX                ; old ESP-4 push       PUSH      [EBP]                  ; old EBP push            ;MOV        ESP, EBP     ;SUB  ESP, 4                          ; ESP 원래 위치로     ;POPFD                                  ; EFL 복원          MOV ESP, EBP                       ; Exit code   POP EBP   RET   _LINUX  ENDP END                                        ※ 프로시저로 부터 리턴된 후에 레지스터값과  변수들에 담긴 값을 비교하면 일치함