原文:https://www.pediy.com/kssd/pediy10/74644.html
一、程序BUG
代码:
77EFB0A3 . 57 push edi 77EFB0A4 . 8D45 D8 lea eax, dword ptr [ebp-28] 77EFB0A7 . 50 push eax 77EFB0A8 . FF75 34 push dword ptr [ebp+34] 77EFB0AB . 56 push esi 77EFB0AC . E8 2FE6FFFF call <pbmiConvertInfo(x,x,x,x)> 77EFB0B1 . 3BC7 cmp eax, edi 77EFB0B3 . 8945 F0 mov dword ptr [ebp-10], eax 77EFB0B6 . 0F84 C7150100 je <loc_77F0C683> 77EFB0BC . 8B75 F0 mov esi, dword ptr [ebp-10] 77EFB0BF . 56 push esi 77EFB0C0 . E8 3AFBFFFF call <cjBitmapBitsSize(x)> 77EFB0C5 . 8945 D4 mov dword ptr [ebp-2C], eax 77EFB0C8 > > 64:A1 1800000>mov eax, dword ptr fs:[18] 77EFB0CE . F645 2C 03 test byte ptr [ebp+2C], 3 77EFB0D2 . 89B8 D0060000 mov dword ptr [eax+6D0], edi 77EFB0D8 . 0F85 46150100 jnz <loc_77F0C624>
77F0C624 > > \64:A1 1800000>mov eax, dword ptr fs:[18] 77F0C62A . FF75 D4 push dword ptr [ebp-2C] 77F0C62D . 8B40 30 mov eax, dword ptr [eax+30] 77F0C630 . 57 push edi 77F0C631 . FF70 18 push dword ptr [eax+18] 77F0C634 . FF15 AC11EF77 call dword ptr [<&ntdll.RtlAllocateHeap>] ; ntdll.RtlAllocateHeap 77F0C63A . 3BC7 cmp eax, edi 77F0C63C . 8945 C4 mov dword ptr [ebp-3C], eax 77F0C63F .^ 0F84 99EAFEFF je <loc_77EFB0DE> 77F0C645 . 8B4D D4 mov ecx, dword ptr [ebp-2C] 77F0C648 . 8B75 2C mov esi, dword ptr [ebp+2C] 77F0C64B . 8BD1 mov edx, ecx 77F0C64D . C1E9 02 shr ecx, 2 77F0C650 . 8BF8 mov edi, eax 77F0C652 . F3:A5 rep movs dword ptr es:[edi], dword ptr [esi] 77F0C654 . 8BCA mov ecx, edx 77F0C656 . 83E1 03 and ecx, 3 77F0C659 . F3:A4 rep movs byte ptr es:[edi], byte ptr [esi] 77F0C65B . 8B75 F0 mov esi, dword ptr [ebp-10] 77F0C65E . 8945 2C mov dword ptr [ebp+2C], eax 77F0C661 . 33FF xor edi, edi 77F0C663 .^ E9 76EAFEFF jmp <loc_77EFB0DE>