jmp和call邪恶变形用法

jmp和call的使用对汇编初学者来说有必要好好研究一下。这里贴出来自己构造的一个变形jmp和call，当然其中变形的不止这两个指令。贴出源码和exe，有兴趣的可以瞧瞧，放在OD里调试下或许更有趣。供更我一样刚入门的小菜娱乐，高手勿笑。

;※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※

; flyit.exe

;※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※

; Author: Goly

; Email: [e-mail]

; QQ: 402295354

; Site:

;★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★

; Core Code:

; 1.call伪装为jmp

; 2.jmp伪装为call

;★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★



.386

.model flat, stdcall

option casemap:none



include windows.inc

include user32.inc

include kernel32.inc

includelib user32.lib

includelib kernel32.lib





.const

szString db 'Test',0

.data

buffer dd 2 dup(?)

.code

start:

push offset _exit

lea edi,buffer

push offset buffer

mov eax,3D2404c7h

stosd

mov eax,0c3004010h

stosd

shr eax,24

stosb

stosb

dec edi

push offset _call

jmp edi

_call:

pop edi

call edi

_msg:

push MB_OK

push offset szString

push dword ptr[esp]

push 0

call MessageBox

_exit:

mov dword ptr[esp],0

;push 7ABCDE65h

jmp ExitProcess

end start

 flyit.rar