经典定长指令——修改 ERX

一、50 系列

50      PUSH EAX
51      PUSH ECX
52      PUSH EDX
53      PUSH EBX
54      PUSH ESP
55      PUSH EBP
56      PUSH ESI
57      PUSH EDI

58      POP  EAX
59      POP  ECX
5A      POP  EDX
5B      POP  EBX
5C      POP  ESP
5D      POP  EBP
5E      POP  ESI
5F      POP  EDI

二、INC/DEC

0x40 - 0x47      INC EAX - INC EDI
0x48 - 0x4F      DEC EAX - DEC EDI

三、MOV Rb,Ib

BO系列代表着 MOV指令,它是定长指令,Opcode是一个字节,但是整个指令长度是两个字节
B0 A4      MOV AL,0A4
B1 00      MOV CL,0
B2 00      MOV DL,0
B3 00      MOV BL,0
B4 00      MOV AH,0
B5 00      MOV CH,0
B6 00      MOV DH,0
B7 00      MOV BH,0

B8 8DA42400      MOV,EAX,24A48D
B9 0             MOV,ECX,0
BA 0             MOV,EDX,0
BB 0             MOV,EBX,0
BC 0             MOV,ESP,0
BD 0             MOV,EBP,0
BE 0             MOV,ESI,0
BF 0             MOV,EDI,0

四、 XCHG EAX,ERX

XCHG 是将两个寄存器的值进行交换
90      NOP 
91      XCHG EAX,ECX
92      XCHG EAX,EDX
93      XCHG EAX,EBX
94      XCHG EAX,ESP
95      XCHG EAX,EBP
96      XCHG EAX,ESI
97      XCHG EAX,EDI
posted @ 2020-11-19 15:18  lnterpreter  阅读(175)  评论(0编辑  收藏  举报