OllyDBG入门教程
2OO\'%*
2OO\'%* s =,3 _" _
2OO\'%*
2OO\'%* 5$5 _"
-
_ 2OO\'%*H[H
-
2OO\'%*H[H
-
Y
2OO\'%* Y" ' p Y" p
$8 )) - ! v ' &38 Y" p 3 v
$
)
v Y" )38
# 77 #) p
W
+(; 6 p c .+
p
) W J 1
c 8''
)
(" +
W '
) 3- / W - !
2OO\'%* -
)
(-/ 1 2OO\'%* _ ) ?2OO\'%* 8'' c ? p -/ 2OO\'%* p J (6 & % t ? ) ) - + / W 2OO\'%* - ) t / W 2OO\'%* G 3 + . p0 $ 3 8'' - 8'' p )) 8 )) - > - 2OO\'%* 1 > p - 8'' )) "" 8 - 8'' 2OO\'%* 6 Js p-. " ( XGG ? - p-. / ))- ' - !))
μ ?
-/ 6 - "?
3
t))
2OO\'%* q
-/
W 2OO\'%* ) ) 1 2OO\'%* ' - H[H c GOO -d 2OO\GEJ e' - )) 1 2OO\'%* ' ' - ! ) G d 2OO\GEJ " ' e d e ' ? - - ) d " ' 2OO\GEJe d e 2OO\'%* 3/8*,1 -/ )) 2OO\'%* ) ' ) - ' ! ' - )) ! 2OO\'%* ' ! ? ) - )) -/ 8 - v · - ) ) $ s ? - 2OO\'%* W 1 %W '// 2OO\'%* P 2OO\'%* s P
$
- 2OO\'%* 1
.
s
ROO\GEJLQL
WHVWH[H
)) "? ) ) ) 6RIW,&( ) ) ) -t · 6RIW,&( ′ ) $
? G t
-. ) ) 6RIW,&(
-
·
Y"
&$//
-
J
) 6RIW,&( ) 8 3 · ) "
Z
&$//
- J
-
G
G ) UHW ))
6RIW,&( ? "
) 6RIW,&( ) ))
&75 )
$/7 ) ·
--
))
6RIW,&(
)
) )
?
)) $
L
--
))
3
2OO\'%*
p
#
) FKX[XH]KH
c
KWWS EEVSHGL\FRPVKRZWKUHDGSKS"V WKUHDGLG " % L 8OWUD 6WULQJ 5HIHUHQFH p 1 p %W ( p. ? L L L -1 . I. 2' % $/ P (% ) " v-- ) ó
FUDFNPHVFMEQHW ′ 83; q G ?c ( -/1 ? G) G 2OO\'%* )) GW 3G W ￥ 8 G = ) ) " . 8 # ) .H\ NH\ILOH ) v -. J J W 8 -.. $ I ) ( % L :+ - 11 ? . J & ) )") " 8 9& 'HOSKL 9% J 3(L' < ), ) / 2OO\'%* )) × )) G - FUDFNPH 3(L' ? 'HOSKL " 8
1 &)) &UDFNPH ￥ 2OO\'%*
w
w -
G
-
FUDFNPH "1 ′ <
. 3-
? WμABA
d5HJLVWHU QRZ e
+
)
3- 1 ) ) ! &UDFN0HH[H
d:URQJ 6HULDO WU\ DJDLQ e -/
μ W 2OO\'%* -'
Y"
'
!
#
p
8 p # 3 ￥ 2OO\'%* 2OO\'%* % $ 3 ) - ) / d:URQJ 6HULDO WU\ DJDLQ e )d:URQJe -/ v Z
. -d L
/ e'
p
'
d
Y"
+ e
-/
(-
- J
#
- -
'
#!
)
) _ %$ &
$6&,, :URQJ 6HULDO WU\ DJDLQ
029 ('; &UDFN0H&
)( ) ) )$ )& )( ) ) ) ' ) )
_ _ _ _ _! _ _ _ _ _
$ & % ( '(&)))) (% $ % %$ & $ & % ( &&)))) W
029 ($; ':25' 375 '6 >&@ 029 ($; ':25' 375 '6 >($;@ &$// &UDFN0H' -03 6+257 &UDFN0H)$ 386+ 029 (&; &UDFN0H 029 ('; &UDFN0H& 029 ($; ':25' 375 '6 >&@ 029 ($; ':25' 375 '6 >($;@ &$// &UDFN0H'
$6&,, %HJJDU RII $6&,, :URQJ 6HULDO WU\ DJDLQ
Y" _ _ _ _ _ _ _ _ _ _ _ _ _
)& )) ) ) )% )( ) ) )& ) ) ) )$ \ )) &UDFN0H ) ) )% ) ) ) ) )( ) ) )$ )& )( ) )
% )& %$ ( )%)&)) ' )& % & ( ')()')) % )& %$ & ( '%)&)) $ $ 386+ % &
029 ($; ':25' 375 66 >(%3@ 029 ('; &UDFN0H &$// &UDFN0H%& -1= 6+257 &UDFN0H)& /($ ('; ':25' 375 66 >(%3@ 029 ($; ':25' 375 '6 >(%; &@ &$// &UDFN0H( 029 ($; ':25' 375 66 >(%3@ 029 ('; &UDFN0H& &$// &UDFN0H%& -1= 6+257 &UDFN0H) 029 (&; &UDFN0H& 029 ('; &UDFN0H& 029 ($; ':25' 375 '6 >&@ 029 ($; ':25' 375 '6 >($;@ &$// &UDFN0H' -03 6+257 &UDFN0H)$ 386+ 029 (&; &UDFN0H 029 ('; &UDFN0H& 029 ($; ':25' 375 '6 >&@ 029 ($; ':25' 375 '6 >($;@ &$// &UDFN0H' -03 6+257 &UDFN0H)$ 386+ 029 (&; &UDFN0H 029 ('; &UDFN0H& 029 ($; ':25' 375 '6 >&@
$6&,, 5HJLVWHUHG 8VHU ) +-b -/+
$6&,, *);,(5 ) +-b -/+ $6&,, &UDFN0H FUDFNHG VXFFHVVIXOO $6&,, &RQJUDWV
$6&,, %HJJDU RII $6&,, :URQJ 6HULDO WU\ DJDLQ
$6&,, %HJJDU RII $6&,, :URQJ 6HULDO WU\ DJDLQ
) ' _ % ) ) _ ( &&))))
029 ($; ':25' 375 '6 >($;@ &$// &UDFN0H'
v !&38 1d .)
0 $ + dZURQJ VHULDO WU\ DJDLQe+ + ecJ d8+ ) + p
p
) J ? t 8 ))+ e d + -t3 + e
)& ) 8 &&'HEXJHU " d5HJLVWHU QRZ e 1 2OO\'%* +v-/ 66 >) $&@ ''% ($; $6&,, &&'HEXJHU
) (
- d *);,(5 e
" ) -
p ''% 66 >) $&@ ''% $6&,, &&'HEXJHU + e 8 &&'HEXJHU p 8
-
v -/ &&'HEXJHU v - ? ' v # ($;
-d v ?
) 029 ($; ':25' 375 66 >(%3@ 029 ('; &UDFN0H &$// &UDFN0H%& -1= 6+257 &UDFN0H)& 1 v($; -/
)& _ % )& d&&'HEXJHUe )) _ %$ ) _ ( )%)&)) ) _ -
$6&,, 5HJLVWHUHG 8VHU ) +-b -/+ ) -
) ) _ ( )%)&)) &$// -b G -
&$// &UDFN0H%& -
%& %' %( %) % (', % % %% _ _ _ _
. 386+ (%; . & '
386+ (6,
. )
p
)
386+ (%; 386+ (6, 386+ (', 029 (6, ($; 029 (', ('; &03 ($; ('; -( &UDFN0H%&$ 7(67 (6, (6, -( 6+257 &UDFN0H%$ 7(67 (', (', -( 6+257 &UDFN0H%$( 029 ($; ':25' 375 '6 >(6,@ 029 ('; ':25' 375 '6 >(',@ 68% ($; ('; -$ 6+257 &UDFN0H%) $'' ('; ($; 386+ ('; 6+5 ('; -( 6+257 &UDFN0H%% 029 029 &03 -1= (&; ':25' 375 '6 >(6,@ (%; ':25' 375 '6 >(',@ (&; (%; 6+257 &UDFN0H%%
1 ($; 1 ('; ′
′ (6, d5HJLVWHUHG 8VHUe′
_ ' _ ) ) _ ) ′ _ _ )) _ % _ % )& _ % )& _ '
d5HJLVWHUHG 8VHUe< + (6, ( +
(
%' %) % % % % ? %% _ + %' _ & ′ ? %) _! % _ &($ % _ ? $ % _! %( % _ %) % _ ' %% _ / " ) + )
′ ?- ($; d5HJLVWHUHG 8VHUep ?- ('; 1 ′ ?
d5HJLVWHUHG 8VHUe ?
′
? c-
-/ ′
?
1 ′ - (&; 1d5HJLVWHUHG 8VHUe- (%; ) ) 2OO\'%* ) t (
′ d5HJLVWHUHG 8VHUe ) d5HJLVWHUHG 8VHUe d5HJLVWHU QRZ e &$// " - - ) +-b-
) _ % )& )& _ %$ & ) _ ( '%)&))
029 ($; ':25' 375 66 >(%3@ 029 ('; &UDFN0H& &$// &UDFN0H%&
$6&,, *);,(5 ) +-b
) _ $
-1= 6+257 &UDFN0H)
-/+ ) #1 d%e
v ) &$// &UDFN0H%& < &$// &UDFN0H%& Y" . -) ? ′ < &$// " - · ?v ? " &$// )& d*);,(5 e 2. 3- "? ' ! $/7 % J
( ) ># 1$ -/( 1 > ./ - - G 1 2OO\'%* ) ′ 5HJLVWHUHG 8VHU *);,(5 d5HJLVWHU QRZ e 11 -
(8 " "
) ? v
-
2OO\'%*
FUDFNPHVFMEQHW /
#
2OO\'%* ( &UDFN+HDG FUDFNPH # # G# $ -
1 -d7U\ ,We
8
' d6KLWe
6KLW
11
?'
d&KHFN ,We ) J p -b ). p ( 0$60 7$60 ? ) ' )) )p 3 #- 2OO\'%* Y" 6 ? ' - &75 1 "1" 8-/)) &UDFN+HD@e )) -
de)) )) p W 3(L' ? " ? 2OO\'%* ) 8 G d&KHFN ,We $3, )) - ! # 2OO\'%* )) 2OO\'%* d>&38 ( ? ) 8
.
:
"
$6&,, 8 *HW'OJ,WHP7H[W:
- $3, *HW'OJ,WHP7H[W c *HW:LQGRZ7H[W $ 8 *HW'OJ,WHP7H[W$ 81,&2'( ")( 81&2'( $ :LQ $( :LQ ?
I
81,&2'( " # 17 " 81,&2'( " p $6&,, < 81,&2'( ) ) . $6&,, d$e" c+ 11 )) )) ) *HW'OJ,WHP7H[W$ *HW:LQGRZ7H[W$ -3 *HW:LQGRZ7H[W$ ? ' d # e 2OO\'%* / d e *HW:LQGRZ7H[W$ ? ' -d #e # )
1 . d # ))
e -
. d&KHFN ,We
2OO\'%*
3
3
))
_ ( & &$// -03 86(5*HW:LQGRZ7H[W$! *HW:LQGRZ7H[W$ _ ( $ &$// &UDFN+HD' ) +-b ' _ %& &03 ($; (6, ) _ -1= 6+257 &UDFN+HD _ (% & -03 6+257 &UDFN+HD) _ ( ) ! $6&,, 1RZ ZULWH D NH\J _ ( ! $6&,, HQ DQG WXW DQG \ _ ) ! $6&,, RX UH GRQH ) _! $ 386+ 6W\OH 0%B2._0%B$33/02'$/ _ ) 386+ &UDFN+HD) 7LWOH &UXGG V &UDFN +HDG _ 386+ &UDFN+HD 7H[W 1RZ ZULWH D NH\JHQ DQG WXW DQG \RX UH G RQH % _ )) 386+ ':25' 375 66 >(%3 @ K2ZQHU ( _ ( &$// -03 86(50HVVDJH%R[$! 0HVVDJH%R[$ ?v &$// &UDFN+HD' ++ # ) d&UXGG V &UDFN +HDGe ) v d1RZ ZULWH D NH\JHQ DQG WXW DQG \RX UH GRQHe ) O - &$// &UDFN+HD' ) +-b ) - ) ) + - $ )) & )) )) & )) -03 ':25' 375 '6 > -03 ':25' 375 '6 > -03 ':25' 375 '6 > -03 ':25' 375 '6 > 86(5*HW:LQGRZ7H[W! 86(5*HW:LQGRZ7H[W$ 86(5/RDG&XUVRU$!@ 86(5/RDG&XUVRU$ 86(5/RDG,FRQ$!@ 86(5/RDG,FRQ$ 86(5/RDG0HQX$!@ 86(5/RDG0HQX$
& )) + - 1 - + 8VHUGOO 2OO\'%* Y" '& $ & '( $' ' ( )()) )
-03 ':25' 375 '6 > 86(50HVVDJH%R[$!@ ) 2OO\'%* ?
86(50HVVDJH%R[$
? ) d>&38 ( 86(5@ + " -
386+ & 386+ 86(5'$ &$// 86(5'& $/7 ) 1 ) +-b
_ ( $ &$// &UDFN+HD' ' _ %& &03 ($; (6, ) _ -1= 6+257 &UDFN+HD G ) +-
' 386+ (6, (6, ' _ & ;25 ($; ($; ($; ' _ ' & /($ (6, ':25' 375 '6 >&@ 1 - (6, '% _ & ;25 (&; (&; (&; '' _ ' ;25 ('; ('; ('; ') _ $ 029 $/ %<7( 375 '6 >(6,@ 1 p - $/ ( _ ,1& (6, p ( _ & ' &03 $/ ' 1 ? p -P ( ' p de -/ ( * ( _ -1= 6+257 &UDFN+HD(( + ( _ %$ )))))))) 029 ('; 8 * 1 - ('; -P )))))))) (% _ $ 029 $/ %<7( 375 '6 >(6,@ de p (' _ ,1& (6, p (( _! (% % -03 6+257 &UDFN+HD)% ) _! & 68% $/ p -P (-/. p 8 $6&,, d+e + ( ) _ '& /($ (&; ':25' 375 '6 >(&; (&; @ 1 p (&; " * (&; ) _ '& /($ (&; ':25' 375 '6 >($; (&; @ p p - (&; ) _ $ 029 $/ %<7( 375 '6 >(6,@ p )$ _ ,1& (6, p )% _! $& 25 $/ $/ )' _A ) -1= 6+257 &UDFN+HD) < ( 1 ′ )) _ '$ /($ ($; ':25' 375 '6 >('; (&;@ 1 ('; " (&;
- ($; _ & ;25 ($; ('; 1 ($; _ ( 323 (6, /- ? $ _ ) $ ;25 (6, $ % ? & 5(71
1 ($; (6,
('; 8 - <
* # -
$ (6,
1 (6,
$+
-/ % - ' _ %& ) _ G
(6, p 5(71 -/ )
G -/ ))d3 e -d &$//
) 5(7 5(71e --/
&03 ($; (6, -1= 6+257 &UDFN+HD
($; p "
- '
(6, (%)) ($; )) (%( - (6, (%)) ? ' -d p e -
$
+ ($; )) (%( >
(-
FUDFNPH
")-
?
p de " P
(- p )) "
" ? )
1p
(
p (6,
11 2 - ? ) 1 G) -/
- FUDFNPH (6, p 8 (6, (6, p
L p
G L J 8 / - 2OO\'%*
3 > $
) W - FUDFNPH p
2OO\'%*
?
p
v - (6, 8 - # . 1 p 2OO\'%* FUDFNPH (6,
2OO\'%* ) / p $ - - ? )
_ ( & &$// -03 86(5*HW:LQGRZ7H[W$! _ ( $ &$// &UDFN+HD' ' _ %& &03 ($; (6, ) _ -1= 6+257 &UDFN+HD / $ $ 2OO\'%* (6, ) /
*HW:LQGRZ7H[W$ ) +-b
-
)
p
(6,
p
p &
-
p &
)
/
$
v -/ ;;;;;;;; J
'6 > &@ )&)$$ ) -/ )&)$$
$
'6 > &@ ;;;;;;;;
-/
p & " - ) ) $ # L p $ 2OO\'%* pL $ ) ) 2OO\'%* ' ))!/ # &75 ) J / + d? e ) ))sI 1d ?Web? - ) -/ -d e / -
1-
! $
386+
S0RGXOH 18//
p 2OO\'%* p p < pL p p t p pL t p L v # ! ! ! - /HQXV L 8 o ) )) p - KWWS EEVSHGL\FRPVKRZWKUHDGSKS"WKUHDGLG )) J pL - ? v & p - G 2OO\'%* ? 8 ' -J ! &75 * 8
-
)
"
v
p &
t
8
/ - p
& - & - . (
p/ v p p p ( (v -3 6 -
& 2OO\'%* . .
+(; p (
$6&,, pZ $
" )
8 /
p ) p
3%W
-/-
p p P $
)) ) $ )
) & ) & )% & )& ) & )' ( & )( A &% & ) %'
-
1
2OO\'%*
029 %<7( 375 '6 >($;@ &/ ,1& ($; '(& (', '(& (6, -1= 6+257 QWGOO& )% 029 (&; ':25' 375 66 >(%3 @ Y" 8 QWGOOGOO J "
" 8 :LQ ) # -
$
-/
Y"
6
? '
-
!
p
-
p
-
$/7 )
$/7 ) -
_ ' & /($ (6, ':25' 375 '6 > &@ _ )%' (& 029=; (&; %<7( 375 '6 >(&@ ( _ )) ;25 (', (', 1 Y" ## 1