另一个类型的窗口汇编程序及反汇编程序

这个是源代码：

  1 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  2 ; Sample code for < Win32ASM Programming 2nd Edition>
  3 ; by 罗云彬, http://asm.yeah.net
  4 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  5 ; FirstWindow.asm
  6 ; 窗口程序的模板代码
  7 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  8 ; 使用 nmake 或下列命令进行编译和链接:
  9 ; ml /c /coff FirstWindow.asm
 10 ; Link /subsystem:windows FirstWindow.obj
 11 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 12         .386
 13         .model flat,stdcall
 14         option casemap:none
 15 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 16 ; Include 文件定义
 17 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 18 include        windows.inc
 19 include        gdi32.inc
 20 includelib    gdi32.lib
 21 include        user32.inc
 22 includelib    user32.lib
 23 include        kernel32.inc
 24 includelib    kernel32.lib
 25 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 26 ; 数据段
 27 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 28         .data?
 29 hInstance    dd        ?
 30 hWinMain    dd        ?
 31 
 32         .const
 33 szClassName    db    'MyClass',0
 34 szCaptionMain    db    'My first Window !',0
 35 szText        db    'Win32 Assembly, Simple and powerful !',0
 36 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 37 ; 代码段
 38 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 39         .code
 40 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 41 ; 窗口过程
 42 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 43 _ProcWinMain    proc    uses ebx edi esi hWnd,uMsg,wParam,lParam
 44         local    @stPs:PAINTSTRUCT
 45         local    @stRect:RECT
 46         local    @hDc
 47 
 48         mov    eax,uMsg
 49 ;********************************************************************
 50         .if    eax ==    WM_PAINT
 51             invoke    BeginPaint,hWnd,addr @stPs
 52             mov    @hDc,eax
 53 
 54             invoke    GetClientRect,hWnd,addr @stRect
 55             invoke    DrawText,@hDc,addr szText,-1,\
 56                 addr @stRect,\
 57                 DT_SINGLELINE or DT_CENTER or DT_VCENTER
 58 
 59             invoke    EndPaint,hWnd,addr @stPs
 60 ;********************************************************************
 61         .elseif    eax ==    WM_CLOSE
 62             invoke    DestroyWindow,hWinMain
 63             invoke    PostQuitMessage,NULL
 64 ;********************************************************************
 65         .else
 66             invoke    DefWindowProc,hWnd,uMsg,wParam,lParam
 67             ret
 68         .endif
 69 ;********************************************************************
 70         xor    eax,eax
 71         ret
 72 
 73 _ProcWinMain    endp
 74 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 75 _WinMain    proc
 76         local    @stWndClass:WNDCLASSEX
 77         local    @stMsg:MSG
 78 
 79         invoke    GetModuleHandle,NULL
 80         mov    hInstance,eax
 81         invoke    RtlZeroMemory,addr @stWndClass,sizeof @stWndClass
 82 ;********************************************************************
 83 ; 注册窗口类
 84 ;********************************************************************
 85         invoke    LoadCursor,0,IDC_ARROW
 86         mov    @stWndClass.hCursor,eax
 87         push    hInstance
 88         pop    @stWndClass.hInstance
 89         mov    @stWndClass.cbSize,sizeof WNDCLASSEX
 90         mov    @stWndClass.style,CS_HREDRAW or CS_VREDRAW
 91         mov    @stWndClass.lpfnWndProc,offset _ProcWinMain
 92         mov    @stWndClass.hbrBackground,COLOR_WINDOW + 1
 93         mov    @stWndClass.lpszClassName,offset szClassName
 94         invoke    RegisterClassEx,addr @stWndClass
 95 ;********************************************************************
 96 ; 建立并显示窗口
 97 ;********************************************************************
 98         invoke    CreateWindowEx,WS_EX_CLIENTEDGE,offset szClassName,offset szCaptionMain,\
 99             WS_OVERLAPPEDWINDOW,\
100             100,100,600,400,\
101             NULL,NULL,hInstance,NULL
102         mov    hWinMain,eax
103         invoke    ShowWindow,hWinMain,SW_SHOWNORMAL
104         invoke    UpdateWindow,hWinMain
105 ;********************************************************************
106 ; 消息循环
107 ;********************************************************************
108         .while    TRUE
109             invoke    GetMessage,addr @stMsg,NULL,0,0
110             .break    .if eax    == 0
111             invoke    TranslateMessage,addr @stMsg
112             invoke    DispatchMessage,addr @stMsg
113         .endw
114         ret
115 
116 _WinMain    endp
117 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
118 start:
119         call    _WinMain
120         invoke    ExitProcess,NULL
121 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
122         end    start

我在66行的位置处对invoke DefWindowProc,hWnd,uMsg,wParam,lParam没有进行换行处理，一直报错。（我先自己照着书写代码）

error A2008: syntax error : invoke

===============================================

===============================================

start:
        call    _WinMain
        invoke    ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
        end    start

对应的反汇编代码：

1 00401163 >/$  E8 21FFFFFF   call    00401089                         ;  call    _WinMain
2 00401168  |.  6A 00         push    0                                ; /ExitCode = 0
3 0040116A  \.  E8 5B000000   call    <jmp.&kernel32.ExitProcess>      ; \ExitProcess

现在进入_WinMain，汇编代码为：

 1 _WinMain    proc
 2         local    @stWndClass:WNDCLASSEX
 3         local    @stMsg:MSG
 4 
 5         invoke    GetModuleHandle,NULL
 6         mov    hInstance,eax
 7         invoke    RtlZeroMemory,addr @stWndClass,sizeof @stWndClass
 8 ;********************************************************************
 9 ; 注册窗口类
10 ;********************************************************************
11         invoke    LoadCursor,0,IDC_ARROW
12         mov    @stWndClass.hCursor,eax
13         push    hInstance
14         pop    @stWndClass.hInstance
15         mov    @stWndClass.cbSize,sizeof WNDCLASSEX
16         mov    @stWndClass.style,CS_HREDRAW or CS_VREDRAW
17         mov    @stWndClass.lpfnWndProc,offset _ProcWinMain
18         mov    @stWndClass.hbrBackground,COLOR_WINDOW + 1
19         mov    @stWndClass.lpszClassName,offset szClassName
20         invoke    RegisterClassEx,addr @stWndClass
21 ;********************************************************************
22 ; 建立并显示窗口
23 ;********************************************************************
24         invoke    CreateWindowEx,WS_EX_CLIENTEDGE,offset szClassName,offset szCaptionMain,\
25             WS_OVERLAPPEDWINDOW,\
26             100,100,600,400,\
27             NULL,NULL,hInstance,NULL
28         mov    hWinMain,eax
29         invoke    ShowWindow,hWinMain,SW_SHOWNORMAL
30         invoke    UpdateWindow,hWinMain
31 ;********************************************************************
32 ; 消息循环
33 ;********************************************************************
34         .while    TRUE
35             invoke    GetMessage,addr @stMsg,NULL,0,0
36             .break    .if eax    == 0
37             invoke    TranslateMessage,addr @stMsg
38             invoke    DispatchMessage,addr @stMsg
39         .endw
40         ret
41 
42 _WinMain    endp

首先是填充WNDCLASSEX结构，然后是注册窗口类，显示窗口，更新窗口。

 1 00401089  /$  55            push    ebp
 2 0040108A  |.  8BEC          mov     ebp, esp
 3 0040108C  |.  83C4 B4       add     esp, -4C
 4 0040108F  |.  6A 00         push    0                                ; /pModule = NULL
 5 00401091  |.  E8 3A010000   call    <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
 6 00401096  |.  A3 00304000   mov     dword ptr [403000], eax
 7 0040109B  |.  6A 30         push    30                               ; /Length = 30 (48.)
 8 0040109D  |.  8D45 D0       lea     eax, dword ptr [ebp-30]          ; |
 9 004010A0  |.  50            push    eax                              ; |Destination
10 004010A1  |.  E8 30010000   call    <jmp.&kernel32.RtlZeroMemory>    ; \RtlZeroMemory
11 004010A6  |.  68 007F0000   push    7F00                             ; /RsrcName = IDC_ARROW
12 004010AB  |.  6A 00         push    0                                ; |hInst = NULL
13 004010AD  |.  E8 F4000000   call    <jmp.&user32.LoadCursorA>        ; \LoadCursorA
14 004010B2  |.  8945 EC       mov     dword ptr [ebp-14], eax
15 004010B5  |.  FF35 00304000 push    dword ptr [403000]               ;  OtherDia.00400000
16 004010BB  |.  8F45 E4       pop     dword ptr [ebp-1C]
17 004010BE  |.  C745 D0 30000>mov     dword ptr [ebp-30], 30
18 004010C5  |.  C745 D4 03000>mov     dword ptr [ebp-2C], 3
19 004010CC  |.  C745 D8 00104>mov     dword ptr [ebp-28], 00401000
20 004010D3  |.  C745 F0 06000>mov     dword ptr [ebp-10], 6
21 004010DA  |.  C745 F8 50204>mov     dword ptr [ebp-8], 00402050      ;  ASCII "MyClass"
22 004010E1  |.  8D45 D0       lea     eax, dword ptr [ebp-30]
23 004010E4  |.  50            push    eax                              ; /pWndClassEx
24 004010E5  |.  E8 C8000000   call    <jmp.&user32.RegisterClassExA>   ; \RegisterClassExA
25 004010EA  |.  6A 00         push    0                                ; /lParam = NULL
26 004010EC  |.  FF35 00304000 push    dword ptr [403000]               ; |hInst = 00400000
27 004010F2  |.  6A 00         push    0                                ; |hMenu = NULL
28 004010F4  |.  6A 00         push    0                                ; |hParent = NULL
29 004010F6  |.  68 90010000   push    190                              ; |Height = 190 (400.)
30 004010FB  |.  68 58020000   push    258                              ; |Width = 258 (600.)
31 00401100  |.  6A 64         push    64                               ; |Y = 64 (100.)
32 00401102  |.  6A 64         push    64                               ; |X = 64 (100.)
33 00401104  |.  68 0000CF00   push    0CF0000                          ; |Style = WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|
　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　;　WS_SYSMENU|WS_THICKFRAME|WS_CAPTION
34 00401109  |.  68 58204000   push    00402058                         ; |WindowName = "My first Window !"
35 0040110E  |.  68 50204000   push    00402050                         ; |Class = "MyClass"
36 00401113  |.  68 00020000   push    200                              ; |ExtStyle = WS_EX_CLIENTEDGE
37 00401118  |.  E8 59000000   call    <jmp.&user32.CreateWindowExA>    ; \CreateWindowExA
38 0040111D  |.  A3 04304000   mov     dword ptr [403004], eax
39 00401122  |.  6A 01         push    1                                ; /ShowState = SW_SHOWNORMAL
40 00401124  |.  FF35 04304000 push    dword ptr [403004]               ; |hWnd = NULL
41 0040112A  |.  E8 89000000   call    <jmp.&user32.ShowWindow>         ; \ShowWindow
42 0040112F  |.  FF35 04304000 push    dword ptr [403004]               ; /hWnd = NULL
43 00401135  |.  E8 8A000000   call    <jmp.&user32.UpdateWindow>       ; \UpdateWindow
44 0040113A  |>  6A 00         /push    0                               ; /MsgFilterMax = 0
45 0040113C  |.  6A 00         |push    0                               ; |MsgFilterMin = 0
46 0040113E  |.  6A 00         |push    0                               ; |hWnd = NULL
47 00401140  |.  8D45 B4       |lea     eax, dword ptr [ebp-4C]         ; |
48 00401143  |.  50            |push    eax                             ; |pMsg
49 00401144  |.  E8 57000000   |call    <jmp.&user32.GetMessageA>       ; \GetMessageA
50 00401149  |.  0BC0          |or      eax, eax
51 0040114B  |.  74 14         |je      short 00401161
52 0040114D  |.  8D45 B4       |lea     eax, dword ptr [ebp-4C]
53 00401150  |.  50            |push    eax                             ; /pMsg
54 00401151  |.  E8 68000000   |call    <jmp.&user32.TranslateMessage>  ; \TranslateMessage
55 00401156  |.  8D45 B4       |lea     eax, dword ptr [ebp-4C]
56 00401159  |.  50            |push    eax                             ; /pMsg
57 0040115A  |.  E8 29000000   |call    <jmp.&user32.DispatchMessageA>  ; \DispatchMessageA
58 0040115F  |.^ EB D9         \jmp     short 0040113A
59 00401161  |>  C9            leave
60 00401162  \.  C3            retn

我们看看这个窗口的窗口处理函数在哪个位置。

mov    @stWndClass.lpfnWndProc,offset _ProcWinMain

对应的反汇编代码为

004010CC  |.  C745 D8 00104>mov     dword ptr [ebp-28], 00401000     ;  mov @stWndClass.lpfnWndProc,offset _ProcWinMain

我们找到对应的地址并跳转过去看看

 1 00401000  /.  55            push    ebp
 2 00401001  |.  8BEC          mov     ebp, esp
 3 00401003  |.  83C4 AC       add     esp, -54
 4 00401006  |.  53            push    ebx
 5 00401007  |.  57            push    edi
 6 00401008  |.  56            push    esi
 7 00401009  |.  8B45 0C       mov     eax, dword ptr [ebp+C]
 8 0040100C  |.  83F8 0F       cmp     eax, 0F
 9 0040100F  |.  75 3E         jnz     short 0040104F
10 00401011  |.  8D45 C0       lea     eax, dword ptr [ebp-40]
11 00401014  |.  50            push    eax                              ; /pPaintstruct
12 00401015  |.  FF75 08       push    dword ptr [ebp+8]                ; |hWnd
13 00401018  |.  E8 53010000   call    <jmp.&user32.BeginPaint>         ; \BeginPaint
14 0040101D  |.  8945 AC       mov     dword ptr [ebp-54], eax
15 00401020  |.  8D45 B0       lea     eax, dword ptr [ebp-50]
16 00401023  |.  50            push    eax                              ; /pRect
17 00401024  |.  FF75 08       push    dword ptr [ebp+8]                ; |hWnd
18 00401027  |.  E8 6E010000   call    <jmp.&user32.GetClientRect>      ; \GetClientRect
19 0040102C  |.  6A 25         push    25                               ; /Flags = DT_CENTER|DT_VCENTER|DT_SINGLELINE
20 0040102E  |.  8D45 B0       lea     eax, dword ptr [ebp-50]          ; |
21 00401031  |.  50            push    eax                              ; |pRect
22 00401032  |.  6A FF         push    -1                               ; |Count = FFFFFFFF (-1.)
23 00401034  |.  68 6A204000   push    0040206A                         ; |Text = "Win32 Assembly, Simple and powerful !"
24 00401039  |.  FF75 AC       push    dword ptr [ebp-54]               ; |hDC
25 0040103C  |.  E8 4D010000   call    <jmp.&user32.DrawTextA>          ; \DrawTextA
26 00401041  |.  8D45 C0       lea     eax, dword ptr [ebp-40]
27 00401044  |.  50            push    eax                              ; /pPaintstruct
28 00401045  |.  FF75 08       push    dword ptr [ebp+8]                ; |hWnd
29 00401048  |.  E8 47010000   call    <jmp.&user32.EndPaint>           ; \EndPaint
30 0040104D  |.  EB 31         jmp     short 00401080
31 0040104F  |>  83F8 10       cmp     eax, 10
32 00401052  |.  75 14         jnz     short 00401068
33 00401054  |.  FF35 04304000 push    dword ptr [403004]               ; /hWnd = 001107D4 ('My first Window !',class='MyClass')
34 0040105A  |.  E8 23010000   call    <jmp.&user32.DestroyWindow>      ; \DestroyWindow
35 0040105F  |.  6A 00         push    0                                ; /ExitCode = 0
36 00401061  |.  E8 46010000   call    <jmp.&user32.PostQuitMessage>    ; \PostQuitMessage
37 00401066  |.  EB 18         jmp     short 00401080
38 00401068  |>  FF75 14       push    dword ptr [ebp+14]               ; /lParam
39 0040106B  |.  FF75 10       push    dword ptr [ebp+10]               ; |wParam
40 0040106E  |.  FF75 0C       push    dword ptr [ebp+C]                ; |Message
41 00401071  |.  FF75 08       push    dword ptr [ebp+8]                ; |hWnd
42 00401074  |.  E8 03010000   call    <jmp.&user32.DefWindowProcA>     ; \DefWindowProcA
43 00401079  |.  5E            pop     esi
44 0040107A  |.  5F            pop     edi
45 0040107B  |.  5B            pop     ebx
46 0040107C  |.  C9            leave
47 0040107D  |.  C2 1000       retn    10
48 00401080  |>  33C0          xor     eax, eax
49 00401082  |.  5E            pop     esi
50 00401083  |.  5F            pop     edi
51 00401084  |.  5B            pop     ebx
52 00401085  |.  C9            leave
53 00401086  \.  C2 1000       retn    10

再来看看对应的源代码：

 1 _ProcWinMain    proc    uses ebx edi esi hWnd,uMsg,wParam,lParam
 2         local    @stPs:PAINTSTRUCT
 3         local    @stRect:RECT
 4         local    @hDc
 5 
 6         mov    eax,uMsg
 7 ;********************************************************************
 8         .if    eax ==    WM_PAINT
 9             invoke    BeginPaint,hWnd,addr @stPs
10             mov    @hDc,eax
11 
12             invoke    GetClientRect,hWnd,addr @stRect
13             invoke    DrawText,@hDc,addr szText,-1,\
14                 addr @stRect,\
15                 DT_SINGLELINE or DT_CENTER or DT_VCENTER
16 
17             invoke    EndPaint,hWnd,addr @stPs
18 ;********************************************************************
19         .elseif    eax ==    WM_CLOSE
20             invoke    DestroyWindow,hWinMain
21             invoke    PostQuitMessage,NULL
22 ;********************************************************************
23         .else
24             invoke    DefWindowProc,hWnd,uMsg,wParam,lParam
25             ret
26         .endif
27 ;********************************************************************
28         xor    eax,eax
29         ret
30 
31 _ProcWinMain    endp

对应起来差距不是很大，这样看代码会觉得清晰很多，如果我们写的代码和反汇编的代码基本一样，就说明技术过关了。

【推广】 免费学中医，健康全家人
原文地址：https://www.cnblogs.com/tk091/p/2684038.html