1、第六课 动态调试预备知识一、APIWindows 程序都是高级程序，它需要调用通用的系统底层函数，这些函数被封装在kerner32.dll、user32.dll、gdi2.dll 等 dll 中。底层和高层之间的联络是通过 api 来牵线搭桥的。api 就像和珅，皇帝和大臣之间的沟通、上下级传达都得通过他来实现。 Kernerl32.dll 为系统服务，主要为系统内部管理。 Gdi32.dll 主要提供图形服务。 User32.dll 提供用户服务，创建窗口和传递消息等。例如：某函数定义如下：函数（参数 1，参数 2，参数 3，参数 4）则汇编语言的函数调用为Push 参数 4Push 参数
2、3Push 参数 2Push 参数 1Call 函数 返回值永远保存在 eax 中下面看一个用 32 位汇编编写的应用程序。此程序运行后弹出一个消息框，点确定按钮后，程序退出。其 ollydbg 反汇编代码如下：00403000=MSGBOX2.00403000 (ASCII “Iczelions tutorial no.2“) 消息框标题00403019=MSGBOX2.00403019 (ASCII “Win32 Assembly is Great!“) 消息框正文其中用到了 api 函数：MessageBox 和 ExitProcess。查 api 手册，MessageBox 原型如下：
3、以下全部来自 api 手册MessageBox The MessageBox function creates, displays, and operates a message box. The message box contains an application-defined message and title, plus any combination of predefined icons and push buttons. int MessageBox(HWND hWnd, / handle of owner window 父窗口句柄LPCTSTR lpText, / addre
4、ss of text in message box 消息正文内容地址LPCTSTR lpCaption, / address of title of message box 消息标题地址UINT uType / style of message box 消息框的类型);ParametershWndIdentifies the owner window of the message box to be created. If this parameter is NULL, the message box has no owner window. lpTextPoints to a null-te
5、rminated string containing the message to be displayed. lpCaptionPoints to a null-terminated string used for the dialog box title. If this parameter is NULL, the default title Error is used. uTypeSpecifies a set of bit flags that determine the contents and behavior of the dialog box. This parameter
6、can be a combination of flags from the following groups of flags. Specify one of the following flags to indicate the buttons contained in the message box:Flag MeaningMB_ABORTRETRYIGNORE The message box contains three push buttons: Abort, Retry, and Ignore.MB_OK The message box contains one push butt
7、on: OK. This is the default.MB_OKCANCEL The message box contains two push buttons: OK and Cancel.MB_RETRYCANCEL The message box contains two push buttons: Retry and Cancel.MB_YESNO The message box contains two push buttons: Yes and No.MB_YESNOCANCEL The message box contains three push buttons: Yes,
8、No, and Cancel.Specify one of the following flags to display an icon in the message box:Flag MeaningMB_ICONEXCLAMATION, MB_ICONWARNINGAn exclamation-point icon appears in the message box.MB_ICONINFORMATION, MB_ICONASTERISKAn icon consisting of a lowercase letter i in a circle appears in the message
9、box.MB_ICONQUESTION A question-mark icon appears in the message box.MB_ICONSTOP, MB_ICONERROR, MB_ICONHANDA stop-sign icon appears in the message box.Specify one of the following flags to indicate the default button:Flag MeaningMB_DEFBUTTON1 The first button is the default button. MB_DEFBUTTON1 is t
10、he default unless MB_DEFBUTTON2, MB_DEFBUTTON3, or MB_DEFBUTTON4 is specified.MB_DEFBUTTON2 The second button is the default button.MB_DEFBUTTON3 The third button is the default button.MB_DEFBUTTON4 The fourth button is the default button.Specify one of the following flags to indicate the modality o
11、f the dialog box:Flag MeaningMB_APPLMODAL The user must respond to the message box before continuing work in the window identified by the hWnd parameter. However, the user can move to the windows of other applications and work in those windows. Depending on the hierarchy of windows in the applicatio
12、n, the user may be able to move to other windows within the application. All child windows of the parent of the message box are automatically disabled, but popup windows are not.MB_APPLMODAL is the default if neither MB_SYSTEMMODAL nor MB_TASKMODAL is specified.MB_SYSTEMMODAL Same as MB_APPLMODAL ex
13、cept that the message box has the WS_EX_TOPMOST style. Use system-modal message boxes to notify the user of serious, potentially damaging errors that require immediate attention (for example, running out of memory). This flag has no effect on the users ability to interact with windows other than tho
14、se associated with hWnd.MB_TASKMODAL Same as MB_APPLMODAL except that all the top-level windows belonging to the current task are disabled if the hWnd parameter is NULL. Use this flag when the calling application or library does not have a window handle available but still needs to prevent input to
15、other windows in the current application without suspending other applications.In addition, you can specify the following flags: MB_DEFAULT_DESKTOP_ONLYThe desktop currently receiving input must be a default desktop; otherwise, the function fails. A default desktop is one an application runs on afte
16、r the user has logged on.MB_HELPAdds a Help button to the message box. Choosing the Help button or pressing F1 generates a Help event.MB_RIGHTThe text is right-justified.MB_RTLREADINGDisplays message and caption text using right-to-left reading order on Hebrew and Arabic systems. MB_SETFOREGROUNDThe
17、 message box becomes the foreground window. Internally, Windows calls the SetForegroundWindow function for the message box.MB_TOPMOSTThe message box is created with the WS_EX_TOPMOST window style.MB_SERVICE_NOTIFICATIONWindows NT only: The caller is a service notifying the user of an event. The func
18、tion displays a message box on the current active desktop, even if there is no user logged on to the computer.If this flag is set, the hWnd parameter must be NULL. This is so the message box can appear on a desktop other than the desktop corresponding to the hWnd.For Windows NT version 4.0, the valu
19、e of MB_SERVICE_NOTIFICATION has changed. See WINUSER.H for the old and new values. Windows NT 4.0 provides backward compatibility for pre-existing services by mapping the old value to the new value in the implementation of MessageBox and MessageBoxEx. This mapping is only done for executables that
20、have a version number, as set by the linker, less than 4.0.To build a service that uses MB_SERVICE_NOTIFICATION, and can run on both Windows NT 3.x and Windows NT 4.0, you have two choices.1. At link-time, specify a version number less than 4.0; or2. At link-time, specify version 4.0. At run-time, u
21、se the GetVersionEx function to check the system version. Then when running on Windows NT 3.x, use MB_SERVICE_NOTIFICATION_NT3X; and on Windows NT 4.0, use MB_SERVICE_NOTIFICATION. MB_SERVICE_NOTIFICATION_NT3XWindows NT only: This value corresponds to the value defined for MB_SERVICE_NOTIFICATION fo
22、r Windows NT version 3.51.Return Values 返回值The return value is zero if there is not enough memory to create the message box.If the function succeeds, the return value is one of the following menu-item values returned by the dialog box: Value MeaningIDABORT Abort button was selected.IDCANCEL Cancel b
23、utton was selected.IDIGNORE Ignore button was selected.IDNO No button was selected.IDOK OK button was selected.IDRETRY Retry button was selected.IDYES Yes button was selected.If a message box has a Cancel button, the function returns the IDCANCEL value if either the ESC key is pressed or the Cancel
24、button is selected. If the message box has no Cancel button, pressing ESC has no effect. RemarksWhen you use a system-modal message box to indicate that the system is low on memory, the strings pointed to by the lpText and lpCaption parameters should not be taken from a resource file, because an att
25、empt to load the resource may fail. When an application calls MessageBox and specifies the MB_ICONHAND and MB_SYSTEMMODAL flags for the uType parameter, Windows displays the resulting message box regardless of available memory. When these flags are specified, Windows limits the length of the message
26、 box text to three lines. Windows does not automatically break the lines to fit in the message box, however, so the message string must contain carriage returns to break the lines at the appropriate places. If you create a message box while a dialog box is present, use the handle of the dialog box a
27、s the hWnd parameter. The hWndparameter should not identify a child window, such as a control in a dialog box. Windows 95: The system can support a maximum of 16,364 window handles.查 api 手册，ExitProcess 原型如下：ExitProcess The ExitProcess function ends a process and all its threads. 函数的作用：中止一个进程VOID Exi
28、tProcess(UINT uExitCode / exit code for all threads );ParametersuExitCode 参数Specifies the exit code for the process, and for all threads that are terminated as a result of this call. Use the GetExitCodeProcess function to retrieve the processs exit value. Use the GetExitCodeThread function to retrie
29、ve a threads exit value. 指定想中断的那个进程的一个退出代码Return Values 返回值This function does not return a value. 这个函数不返回任何值RemarksExitProcess is the preferred method of ending a process. This function provides a clean process shutdown. This includes calling the entry-point function of all attached dynamic-link lib
30、raries (DLLs) with a value indicating that the process is detaching from the DLL. If a process terminates by calling TerminateProcess, the DLLs that the process is attached to are not notified of the process termination. After all attached DLLs have executed any process termination value, this funct
31、ion terminates the current process. Terminating a process causes the following: 1. All of the object handles opened by the process are closed. 2. All of the threads in the process terminate their execution. 3. The state of the process object becomes signaled, satisfying any threads that had been wai
32、ting for the process to terminate. 4. The states of all threads of the process become signaled, satisfying any threads that had been waiting for the threads to terminate. 5. The termination status of the process changes from STILL_ACTIVE to the exit value of the process. Terminating a process does n
33、ot cause child processes to be terminated. Terminating a process does not necessarily remove the process object from the operating system. A process object is deleted when the last handle to the process is closed. The ExitProcess, ExitThread, CreateThread, CreateRemoteThread functions, and a process
34、 that is starting (as the result of a call by CreateProcess) are serialized between each other within a process. Only one of these events can happen in an address space at a time. This means the following restrictions hold: ?During process startup and DLL initialization routines, new threads can be
35、created, but they do not begin execution until DLL initialization is done for the process. ?Only one thread in a process can be in a DLL initialization or detach routine at a time. ?ExitProcess does not return until no threads are in their DLL initialization or detach routines. 如上图，点击 First Bytes：后的
36、按钮如上图：结果和 ollydbg 类似。请和 ollydbg 的相对比，体会区别。Ollydbg 中的402000、402008 都已经被相应的函数所代替。再看看 w32dasm 反编译的结果：Disassembly of File: D:aa 新书 2005TUTE02MSGBOX2.exeCode Offset = 00000400, Code Size = 00000200Data Offset = 00000800, Data Size = 00000200Number of Objects = 0003 (dec), Imagebase = 00400000hObject01: .
37、text RVA: 00001000 Offset: 00000400 Size: 00000200 Flags: 60000020Object02: .rdata RVA: 00002000 Offset: 00000600 Size: 00000200 Flags: 40000040Object03: .data RVA: 00003000 Offset: 00000800 Size: 00000200 Flags: C0000040+ MENU INFORMATION +There Are No Menu Resources in This Application+ DIALOG INF
38、ORMATION +There Are No Dialog Resources in This Application+ IMPORTED FUNCTIONS +Number of Imported Modules = 2 (decimal) 用到了 2 个 dll，如下Import Module 001: KERNEL32.dllImport Module 002: USER32.dll+ IMPORT MODULE DETAILS +Import Module 001: KERNEL32.dllAddr:0000205C hint(0075) Name: ExitProcess 一个函数I
39、mport Module 002: USER32.dllAddr:00002078 hint(01BB) Name: MessageBoxA 另一个函数+ EXPORTED FUNCTIONS +Number of Exported Functions = 0000 (decimal)+ ASSEMBLY CODE LISTING +/* Start of Code in Object .text *Program Entry Point = 00401000 (D:aa 新书 2005TUTE02MSGBOX2.exe File Offset:00001600)/* Program Entr
40、y Point *:00401000 6A00 push 00000000:00401002 6800304000 push 00403000* Possible StringData Ref from Data Obj -“Win32 Assembly is Great!“ 正文文字|:00401007 6819304000 push 00403019:0040100C 6A00 push 00000000* Reference To: USER32.MessageBoxA, Ord:01BBh 下面 call 的函数内容|:0040100E E80D000000 Call 00401020
41、:00401013 6A00 push 00000000* Reference To: KERNEL32.ExitProcess, Ord:0075h 下面 call 的函数内容|:00401015 E800000000 Call 0040101A* Referenced by a CALL at Address:|:00401015 |* Reference To: KERNEL32.ExitProcess, Ord:0075h|:0040101A FF2500204000 Jmp dword ptr 00402000 追入系统函数* Reference To: USER32.MessageBoxA, Ord:01BBh|:00401020 FF2508204000 Jmp dword ptr 00402008 追入系统函数反编译的结果中看不出标题的文字信息。Ollydbg 提供了程序最为详尽的信息，ollydbg 给出了最多的信息量。如上图，点击 EP Section：后的按钮：如上图，点击按钮
