从exe文件中确定变量的值
考虑一下我有一个打印变量值的程序。让我们将该变量称为“i”。二进制文件为“.exe”格式。如何确定“i”的值并了解该特定值是来自“.exe”格式的变量“i”？
Consider that i have a program that prints the value of a variable. Lets term that variable as 'i'. The binary file is of '.exe' format. How to determine the value of 'i' and also understand that the particular value is of the variable 'i' from the '.exe' format ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这取决于变量是局部变量还是全局变量。如果它是全局的，那么使用正确的工具就很容易了（因为我使用 Linux，所以我不能推荐任何特定的工具）。您只需在符号表中找到符号“i”的位置，即可显示“i”的位置。如果你想知道它包含什么值，那么，你只能看到它的初始值，而不是运行时的值（显然，因为你正在查看 exe 文件，而不是运行时的映像）程序）。如果它没有初始化，那么你就看不到它的初始值；否则它的初始值将有望在值位置旁边的工具中可见（可能是十六进制，因此您必须对其进行解码）。
现在，如果它是一个本地变量，那么情况就不同了。该变量根本没有名称，因为编译程序时局部变量名称会丢失。在该函数执行期间，它只会（可能）占据堆栈上的一个位置。例如，第一个变量通常位于
-8(%ebp)中，第二个变量位于-12(%ebp)中，等等 (-4( %ebp)和0(%ebp)是特殊的）。因此，如果您正在查找 exe 的汇编代码，-8(%ebp)很可能会引用函数中的第一个局部变量。同样，您无法知道它有什么价值，因为您静态地查看该 exe。所有这些都取决于使用的编译器以及它设置的优化级别。抱歉没有提供任何具体工具。我假设您可以访问一些反编译工具，这些工具将向您显示汇编代码和符号表。
It depends if the variable is a local or a global. If it's a global, then it's pretty easy with the right tools (I can't recommend any particular ones since I use Linux). You would just find the location of the symbol "i" in the symbol table, and that would show you where 'i' is located. If you want to know what value it contains, well, you can only see its initial value, not its value at runtime (obviously, because you are looking at the exe file, not a running image of the program). If it's uninitialised, then you can't see it's initial value; otherwise its initial value will hopefully be visible in the tool next to the value's location (probably in hexadecimal, so you will have to decode it).
Now if it is a local variable, then it's a different story. The variable won't have a name at all, as local variables names are lost when programs are compiled. It will merely (possibly) occupy a position on the stack, during that function's execution. For example, the first variable is often located in
-8(%ebp), the second in-12(%ebp), etc. (-4(%ebp)and0(%ebp)are special). So if you are looking in the assembly code for the exe, chances are that-8(%ebp)will refer to the first local variable in a function. Again, you can't know what value it has because you're statically looking at the exe. And all of this depends upon which compiler was used, and what optimisation level it was set to.Sorry to not give any specific tools. I am assuming you have accessing to some decompilation tools, which will show you the assembly code and symbol tables.