从8种方法可以看出,COM接口技术的调用方法非常灵活。 当“变态”(俺称之为“红杏”)和COM结合对提高软件的抗击反汇编的能力 可大为提高。(若再加入“汇编数组”技术,就更可想而知了) 真8种方法都会出现在即将出世的HotTask51中,估计俺会在里面大肆变态地 利用“汇编数组”及COM接口技术~~~ void main() { /*------------------------------------------------------ 方法1.函数指针数组调用函数(C语言) (20个字节) -------------------------------------------------------*/ pHotTaskTable[0]();//TaskInit pHotTaskTable[1]();//Task1 pHotTaskTable[2]();//Task2 pHotTaskTable[3]();//Task3 /*------------------------------------------------------ 方法2.直接地址调用函数(见菜农的HotIns.h/c)(3个字节) -------------------------------------------------------*/ _icall_((void *)TaskInit);//TaskInit _icall_((void *)Task1);//Task1 _icall_((void *)Task2);//Task2 _icall_((void *)Task3);//Task3 /*------------------------------------------------------ 方法3.间接地址调用函数(见菜农的HotIns.h/c) (11个字节) -------------------------------------------------------*/ _intjmp_(TaskInit);//TaskInit _intjmp_(Task1);//Task1 _intjmp_(Task2);//Task2 _intjmp_(Task3);//Task3 /*------------------------------------------------------ 方法4.函数名调用函数(C语言) (3个字节) -------------------------------------------------------*/ TaskInit();//TaskInit Task1();//Task1 Task2();//Task2 Task3();//Task3 /*------------------------------------------------------ 方法5.函数指针数组调用函数(C语言HotIns.h/c和COM接口)(15个字节) -------------------------------------------------------*/ _icall_((void *)iHotTaskTable.pVtbl[0]);//TaskInit _icall_((void *)iHotTaskTable.pVtbl[1]);//Task1 _icall_((void *)iHotTaskTable.pVtbl[2]);//Task2 _icall_((void *)iHotTaskTable.pVtbl[3]);//Task3 /*------------------------------------------------------ 方法6.函数指针数组调用函数(C语言HotIns.h/c和COM接口)(22个字节) -------------------------------------------------------*/ _intjmp_((unsigned int)iHotTaskTable.pVtbl[0]);//TaskInit _intjmp_((unsigned int)iHotTaskTable.pVtbl[1]);//Task1 _intjmp_((unsigned int)iHotTaskTable.pVtbl[2]);//Task2 _intjmp_((unsigned int)iHotTaskTable.pVtbl[3]);//Task3 /*------------------------------------------------------ 方法7.函数指针数组调用函数(COM接口函指针数组)(15个字节) -------------------------------------------------------*/ iHotTaskTable.pVtbl[0]();//TaskInit iHotTaskTable.pVtbl[1]();//Task1 iHotTaskTable.pVtbl[2]();//Task2 iHotTaskTable.pVtbl[3]();//Task3 /*------------------------------------------------------ 方法8.函数指针数组调用函数(COM接口函指针名)(15个字节) -------------------------------------------------------*/ iHotTaskTable.lpVtbl.TaskInit();//TaskInit iHotTaskTable.lpVtbl.Task1();//Task1 iHotTaskTable.lpVtbl.Task2();//Task2 iHotTaskTable.lpVtbl.Task3();//Task3 HotTaskStart(TaskInit);//装载根任务 } 下面给出软件仿真跟踪的Keil反汇编代码粘贴: 12: /*------------------------------------------------------ 13: 方法1.函数指针数组调用函数(C语言)(20个字节) 14: -------------------------------------------------------*/ 15: pHotTaskTable[0]();//TaskInit C:0x002E 9004E6 MOV DPTR,#pHotTaskTable(0x04E6) C:0x0031 7401 MOV A,#0x01 C:0x0033 93 MOVC A,@A+DPTR C:0x0034 FA MOV R2,A C:0x0035 7402 MOV A,#0x02 C:0x0037 93 MOVC A,@A+DPTR C:0x0038 F9 MOV R1,A C:0x0039 1204FA LCALL C?ICALL(C:04FA) -------------------------------------------------------------------- C?ICALL: C:0x04FA 8A83 MOV DPH(0x83),R2 C:0x04FC 8982 MOV DPTR(0x82),R1 C?ICALL2: C:0x04FE E4 CLR A C:0x04FF 73 JMP @A+DPTR 19: /*------------------------------------------------------ 20: 方法2.直接地址调用函数(见菜农的HotIns.h/c)(3个字节) 21: -------------------------------------------------------*/ 22: _icall_((void *)TaskInit);//TaskInit C:0x0067 1202DB LCALL TaskInit(C:02DB) 26: /*------------------------------------------------------ 27: 方法3.间接地址调用函数(见菜农的HotIns.h/c)(11个字节) 28: -------------------------------------------------------*/ 29: _intjmp_(TaskInit);//TaskInit C:0x0073 9002DB MOV DPTR,#TaskInit(0x02DB) C:0x0076 1203F3 LCALL _reset_code__(C:03F3) -------------------------------------------------------------------- _reset_code__: C:0x03F3 C082 PUSH DPTR(0x82) C:0x03F5 C083 PUSH DPH(0x83) C:0x03F7 32 RETI 33: /*------------------------------------------------------ 34: 方法4.函数名调用函数(C语言) (3个字节) 35: -------------------------------------------------------*/ 36: TaskInit();//TaskInit C:0x008B 1202DB LCALL TaskInit(C:02DB) 40: /*------------------------------------------------------ 41: 方法5.函数指针数组调用函数(C语言HotIns.h/c和COM接口)(15个字节) 42: -------------------------------------------------------*/ 43: _icall_((void *)iHotTaskTable.pVtbl[0]);//TaskInit C:0x0097 AB3F MOV R3,iHotTaskTable(0x3F) C:0x0099 AA40 MOV R2,0x40 C:0x009B A941 MOV R1,0x41 C:0x009D 1204FA LCALL C?ICALL(C:04FA) -------------------------------------------------------------------- C?ICALL: C:0x04FA 8A83 MOV DPH(0x83),R2 C:0x04FC 8982 MOV DPTR(0x82),R1 C?ICALL2: C:0x04FE E4 CLR A C:0x04FF 73 JMP @A+DPTR 47: /*------------------------------------------------------ 48: 方法6.函数指针数组调用函数(C语言HotIns.h/c和COM接口)(22个字节) 49: -------------------------------------------------------*/ 50: _intjmp_((unsigned int)iHotTaskTable.pVtbl[0]);//TaskInit C:0x00BB AB3F MOV R3,iHotTaskTable(0x3F) C:0x00BD AA40 MOV R2,0x40 C:0x00BF A941 MOV R1,0x41 C:0x00C1 AE02 MOV R6,0x02 C:0x00C3 AF01 MOV R7,0x01 C:0x00C5 8E83 MOV DPH(0x83),R6 C:0x00C7 8F82 MOV DPTR(0x82),R7 C:0x00C9 1203F3 LCALL _reset_code__(C:03F3) -------------------------------------------------------------------- _reset_code__: C:0x03F3 C082 PUSH DPTR(0x82) C:0x03F5 C083 PUSH DPH(0x83) C:0x03F7 32 RETI 54: /*------------------------------------------------------ 55: 方法7.函数指针数组调用函数(COM接口函指针数组)(15个字节) 56: -------------------------------------------------------*/ 57: iHotTaskTable.pVtbl[0]();//TaskInit C:0x00FF AB3F MOV R3,iHotTaskTable(0x3F) C:0x0101 AA40 MOV R2,0x40 C:0x0103 A941 MOV R1,0x41 C:0x0105 1204FA LCALL C?ICALL(C:04FA) -------------------------------------------------------------------- C?ICALL: C:0x04FA 8A83 MOV DPH(0x83),R2 C:0x04FC 8982 MOV DPTR(0x82),R1 C?ICALL2: C:0x04FE E4 CLR A C:0x04FF 73 JMP @A+DPTR 61: /*------------------------------------------------------ 62: 方法8.函数指针数组调用函数(COM接口函指针名)(15个字节) 63: -------------------------------------------------------*/ 64: iHotTaskTable.lpVtbl.TaskInit();//TaskInit C:0x0123 AB3F MOV R3,iHotTaskTable(0x3F) C:0x0125 AA40 MOV R2,0x40 C:0x0127 A941 MOV R1,0x41 C:0x0129 1204FA LCALL C?ICALL(C:04FA) -------------------------------------------------------------------- C?ICALL: C:0x04FA 8A83 MOV DPH(0x83),R2 C:0x04FC 8982 MOV DPTR(0x82),R1 C?ICALL2: C:0x04FE E4 CLR A C:0x04FF 73 JMP @A+DPTR
|