第6课 动态调试预备知识.docx

1、第6课 动态调试预备知识第六课 动态调试预备知识一、APIWindows程序都是高级程序，它需要调用通用的系统底层函数，这些函数被封装在kerner32.dll、user32.dll、gdi2.dll等dll中。底层和高层之间的联络是通过api来牵线搭桥的。api就像和珅，皇帝和大臣之间的沟通、上下级传达都得通过他来实现。 Kernerl32.dll为系统服务，主要为系统内部管理。 Gdi32.dll主要提供图形服务。 User32.dll提供用户服务，创建窗口和传递消息等。例如：某函数定义如下：函数（参数1，参数2，参数3，参数4）则汇编语言的函数调用为Push 参数4Push 参数3Pus

2、h 参数2Push 参数1Call 函数 返回值永远保存在eax中下面看一个用32位汇编编写的应用程序。此程序运行后弹出一个消息框，点确定按钮后，程序退出。其ollydbg反汇编代码如下：00403000=MSGBOX2.00403000 (ASCII Iczelions tutorial no.2) 消息框标题00403019=MSGBOX2.00403019 (ASCII Win32 Assembly is Great!) 消息框正文其中用到了api函数：MessageBox和ExitProcess。查api手册，MessageBox原型如下：以下全部来自api手册MessageBox T

3、he MessageBox function creates, displays, and operates a message box. The message box contains an application-defined message and title, plus any combination of predefined icons and push buttons. int MessageBox( HWND hWnd, / handle of owner window 父窗口句柄 LPCTSTR lpText, / address of text in message b

4、ox 消息正文内容地址 LPCTSTR lpCaption, / address of title of message box 消息标题地址 UINT uType / style of message box 消息框的类型 ); ParametershWndIdentifies the owner window of the message box to be created. If this parameter is NULL, the message box has no owner window. lpTextPoints to a null-terminated string con

5、taining the message to be displayed. lpCaptionPoints to a null-terminated string used for the dialog box title. If this parameter is NULL, the default title Error is used. uTypeSpecifies a set of bit flags that determine the contents and behavior of the dialog box. This parameter can be a combinatio

6、n of flags from the following groups of flags. Specify one of the following flags to indicate the buttons contained in the message box:Flag MeaningMB_ABORTRETRYIGNORE The message box contains three push buttons: Abort, Retry, and Ignore.MB_OK The message box contains one push button: OK. This is the

7、 default.MB_OKCANCEL The message box contains two push buttons: OK and Cancel.MB_RETRYCANCEL The message box contains two push buttons: Retry and Cancel.MB_YESNO The message box contains two push buttons: Yes and No.MB_YESNOCANCEL The message box contains three push buttons: Yes, No, and Cancel. Spe

8、cify one of the following flags to display an icon in the message box:Flag MeaningMB_ICONEXCLAMATION, MB_ICONWARNING An exclamation-point icon appears in the message box.MB_ICONINFORMATION, MB_ICONASTERISK An icon consisting of a lowercase letter i in a circle appears in the message box.MB_ICONQUEST

9、ION A question-mark icon appears in the message box.MB_ICONSTOP, MB_ICONERROR, MB_ICONHAND A stop-sign icon appears in the message box. Specify one of the following flags to indicate the default button:Flag MeaningMB_DEFBUTTON1 The first button is the default button. MB_DEFBUTTON1 is the default unl

10、ess MB_DEFBUTTON2, MB_DEFBUTTON3, or MB_DEFBUTTON4 is specified.MB_DEFBUTTON2 The second button is the default button.MB_DEFBUTTON3 The third button is the default button.MB_DEFBUTTON4 The fourth button is the default button. Specify one of the following flags to indicate the modality of the dialog

11、box:Flag MeaningMB_APPLMODAL The user must respond to the message box before continuing work in the window identified by the hWnd parameter. However, the user can move to the windows of other applications and work in those windows. Depending on the hierarchy of windows in the application, the user m

12、ay be able to move to other windows within the application. All child windows of the parent of the message box are automatically disabled, but popup windows are not.MB_APPLMODAL is the default if neither MB_SYSTEMMODAL nor MB_TASKMODAL is specified.MB_SYSTEMMODAL Same as MB_APPLMODAL except that the

13、 message box has the WS_EX_TOPMOST style. Use system-modal message boxes to notify the user of serious, potentially damaging errors that require immediate attention (for example, running out of memory). This flag has no effect on the users ability to interact with windows other than those associated

14、 with hWnd.MB_TASKMODAL Same as MB_APPLMODAL except that all the top-level windows belonging to the current task are disabled if the hWnd parameter is NULL. Use this flag when the calling application or library does not have a window handle available but still needs to prevent input to other windows

15、 in the current application without suspending other applications. In addition, you can specify the following flags: MB_DEFAULT_DESKTOP_ONLYThe desktop currently receiving input must be a default desktop; otherwise, the function fails. A default desktop is one an application runs on after the user h

16、as logged on.MB_HELPAdds a Help button to the message box. Choosing the Help button or pressing F1 generates a Help event.MB_RIGHTThe text is right-justified.MB_RTLREADINGDisplays message and caption text using right-to-left reading order on Hebrew and Arabic systems. MB_SETFOREGROUNDThe message box

17、 becomes the foreground window. Internally, Windows calls the SetForegroundWindow function for the message box.MB_TOPMOSTThe message box is created with the WS_EX_TOPMOST window style.MB_SERVICE_NOTIFICATIONWindows NT only: The caller is a service notifying the user of an event. The function display

18、s a message box on the current active desktop, even if there is no user logged on to the computer.If this flag is set, the hWnd parameter must be NULL. This is so the message box can appear on a desktop other than the desktop corresponding to the hWnd.For Windows NT version 4.0, the value of MB_SERV

19、ICE_NOTIFICATION has changed. See WINUSER.H for the old and new values. Windows NT 4.0 provides backward compatibility for pre-existing services by mapping the old value to the new value in the implementation of MessageBox and MessageBoxEx. This mapping is only done for executables that have a versi

20、on number, as set by the linker, less than 4.0.To build a service that uses MB_SERVICE_NOTIFICATION, and can run on both Windows NT 3.x and Windows NT 4.0, you have two choices. 1. At link-time, specify a version number less than 4.0; or 2. At link-time, specify version 4.0. At run-time, use the Get

21、VersionEx function to check the system version. Then when running on Windows NT 3.x, use MB_SERVICE_NOTIFICATION_NT3X; and on Windows NT 4.0, use MB_SERVICE_NOTIFICATION. MB_SERVICE_NOTIFICATION_NT3XWindows NT only: This value corresponds to the value defined for MB_SERVICE_NOTIFICATION for Windows

22、NT version 3.51. Return Values返回值The return value is zero if there is not enough memory to create the message box.If the function succeeds, the return value is one of the following menu-item values returned by the dialog box: Value MeaningIDABORT Abort button was selected.IDCANCEL Cancel button was

23、selected.IDIGNORE Ignore button was selected.IDNO No button was selected.IDOK OK button was selected.IDRETRY Retry button was selected.IDYES Yes button was selected. If a message box has a Cancel button, the function returns the IDCANCEL value if either the ESC key is pressed or the Cancel button is

24、 selected. If the message box has no Cancel button, pressing ESC has no effect. RemarksWhen you use a system-modal message box to indicate that the system is low on memory, the strings pointed to by the lpText and lpCaption parameters should not be taken from a resource file, because an attempt to l

25、oad the resource may fail. When an application calls MessageBox and specifies the MB_ICONHAND and MB_SYSTEMMODAL flags for the uType parameter, Windows displays the resulting message box regardless of available memory. When these flags are specified, Windows limits the length of the message box text

26、 to three lines. Windows does not automatically break the lines to fit in the message box, however, so the message string must contain carriage returns to break the lines at the appropriate places. If you create a message box while a dialog box is present, use the handle of the dialog box as the hWn

27、d parameter. The hWnd parameter should not identify a child window, such as a control in a dialog box. Windows 95: The system can support a maximum of 16,364 window handles.查api手册，ExitProcess原型如下：ExitProcess The ExitProcess function ends a process and all its threads. 函数的作用：中止一个进程VOID ExitProcess( U

28、INT uExitCode / exit code for all threads ); ParametersuExitCode参数Specifies the exit code for the process, and for all threads that are terminated as a result of this call. Use the GetExitCodeProcess function to retrieve the processs exit value. Use the GetExitCodeThread function to retrieve a threa

29、ds exit value. 指定想中断的那个进程的一个退出代码 Return Values返回值This function does not return a value. 这个函数不返回任何值RemarksExitProcess is the preferred method of ending a process. This function provides a clean process shutdown. This includes calling the entry-point function of all attached dynamic-link libraries (DL

30、Ls) with a value indicating that the process is detaching from the DLL. If a process terminates by calling TerminateProcess, the DLLs that the process is attached to are not notified of the process termination. After all attached DLLs have executed any process termination value, this function termin

31、ates the current process. Terminating a process causes the following: 1. All of the object handles opened by the process are closed. 2. All of the threads in the process terminate their execution. 3. The state of the process object becomes signaled, satisfying any threads that had been waiting for the process to terminate. 4. The states of all threads of the process become signaled, satisfying any threads that had been waiting for the threads to terminate. 5. The termination status of the process changes from STILL_ACTIVE to the exit value of the process.