x32dbg/x64dbg逆向之反汇编while分析1反汇编while分析while咱们也经常用到在开发中经常会遇到遍历处理数组或是某段逻辑需要反复执行仅少量参数存在差异的场景这时就会选用while语句来实现循环逻辑。编译后映射到汇编代码里具体是什么样子咱们一步步调试看下哦3C语言案例代码单个while咱们在学习逆向分析的同时同步梳理C和C基础知识点一正一反正向开发逆向分析为后续深耕底层技术打好基础哦。#include stdio.hint main(){int i 1;// Single while loop and print numbers 1 to 5while(i 5){printf(%d , i);i;}return 0;}4C语言案例代码多个while咱们在学习逆向分析的同时同步梳理C和C基础知识点一正一反正向开发逆向分析为后续深耕底层技术打好基础哦。#include stdio.hint main(){int x 1;while (x 5){printf(%d , x);x;}printf(\n);printf(\n);x 0;// First while loopwhile (x 2){int y 1;printf(| );// Second middle while loopwhile (y 2){int z 1;// Third innermost while loopwhile (z 3){printf(* );z;}printf(| );y;}printf(\n);x;}return 0;}5反向分析指针单个whilex64Debug版本00007FF780261840 | 40:55 | push rbp | FileName.cpp:300007FF780261842 | 57 | push rdi |00007FF780261843 | 48:81EC 08010000 | sub rsp,108 | 开辟空间00007FF78026184A | 48:8D6C24 20 | lea rbp,qword ptr ss:[rsp20] |00007FF78026184F | 48:8D0D B2F70000 | lea rcx,qword ptr ds:[__14F49BB1_FileN | FileName.cpp:1573248000007FF780261856 | E8 3DFBFFFF | call project1.7FF780261398 |00007FF78026185B | 90 | nop |00007FF78026185C | C745 04 01000000 | mov dword ptr ss:[rbp4],1 | FileName.cpp:4局部变量赋值x 100007FF780261863 | 837D 04 05 | cmp dword ptr ss:[rbp4],5 | FileName.cpp:6对比局部变量是否大于5while (x 5)跳出循环。00007FF780261867 | 7F 1A | jg project1.7FF780261883 | 如果大于跳出00007FF780261869 | 8B55 04 | mov edx,dword ptr ss:[rbp4] | FileName.cpp:8打印的第二个参数00007FF78026186C | 48:8D0D B1830000 | lea rcx,qword ptr ds:[%d ...] | 00007FF780269C24:%d 打印的第一个字符串格式化参数00007FF780261873 | E8 D1F9FFFF | call project1.7FF780261249 | printf00007FF780261878 | 90 | nop |00007FF780261879 | 8B45 04 | mov eax,dword ptr ss:[rbp4] | FileName.cpp:900007FF78026187C | FFC0 | inc eax | i局部变量00007FF78026187E | 8945 04 | mov dword ptr ss:[rbp4],eax |00007FF780261881 | EB E0 | jmp project1.7FF780261863 | FileName.cpp:10继续循环下一次对比00007FF780261883 | 33C0 | xor eax,eax | FileName.cpp:11main准备返回00007FF780261885 | 48:8DA5 E8000000 | lea rsp,qword ptr ss:[rbpE8] | FileName.cpp:1200007FF78026188C | 5F | pop rdi |00007FF78026188D | 5D | pop rbp |00007FF78026188E | C3 | ret |x64Release版本release优化过是先执行一遍再判断00007FF624141070 | 40:53 | push rbx | FileName.cpp:3, rbx:__dyn_tls_dtor_callback00007FF624141072 | 48:83EC 20 | sub rsp,20 | 开辟空间00007FF624141076 | BB 01000000 | mov ebx,1 | FileName.cpp:4x 1;00007FF62414107B | 0F1F4400 00 | nop dword ptr ds:[raxrax],eax |00007FF624141080 | 8BD3 | mov edx,ebx | FileName.cpp:800007FF624141082 | 48:8D0D 77110000 | lea rcx,qword ptr ds:[%d ...] | 00007FF624142200:%d 00007FF624141089 | E8 82FFFFFF | call project1.printf | printf00007FF62414108E | FFC3 | inc ebx | FileName.cpp:9i00007FF624141090 | 83FB 05 | cmp ebx,5 | 对比是否大于500007FF624141093 | 7E EB | jle project1.7FF624141080 | 如果不大于继续循环检测00007FF624141095 | 33C0 | xor eax,eax | FileName.cpp:1100007FF624141097 | 48:83C4 20 | add rsp,20 | FileName.cpp:1200007FF62414109B | 5B | pop rbx | rbx:__dyn_tls_dtor_callback00007FF62414109C | C3 | ret |x86Debug版本002D1840 | 55 | push ebp | FileName.cpp:3002D1841 | 8BEC | mov ebp,esp |002D1843 | 81EC CC000000 | sub esp,CC |002D1849 | 53 | push ebx |002D184A | 56 | push esi | esi:閗\r002D184B | 57 | push edi | edi:閗\r002D184C | 8D7D F4 | lea edi,dword ptr ss:[ebp-C] | [ebp-0C]:BaseThreadInitThunk19002D184F | B9 03000000 | mov ecx,3 | ecx:閗\r002D1854 | B8 CCCCCCCC | mov eax,CCCCCCCC |002D1859 | F3:AB | rep stosd |002D185B | B9 08C02D00 | mov ecx,project1._14F49BB1_FileNamecp | FileName.cpp:15732480, ecx:閗\r002D1860 | E8 B1FAFFFF | call project1.2D1316 |002D1865 | 90 | nop | 上面全部是x86专有的