如何确定可执行文件的作用？
我有一小段机器指令（160 字节），但我不知道它的作用。
我在 Mac 上，在 GDB 反汇编器下运行它，结果如下：
....f3c0: jmp 0x7fff5fbff3c6
....f3c2: scas %es:(%rdi),%eax
....f3c3: retq $0xa3bf
....f3c6: sub $0x100,%esp
....f3cc: xor %ecx,%ecx
....f3ce: mov %cl,(%rsp,%rcx,1)
+ 50 more lines....
我对汇编器知之甚少，但有些命令看起来很有趣（例如 rex.RXB、rex.WB、rex.B）代码>）。经过一番谷歌搜索后，我发现这个命令告诉我这是一个 DOS 可执行文件：
$ file program
program: DOS executable (COM)
- Is there a program that can disassemble a DOS可执行文件？
如果没有，我会尝试手动反汇编它，因为只有 160 字节。不过，我需要参考每个字节的含义。例如
90 = NOP
8a = MOV
....
是否有类似 DOS 机器代码指令的参考？
我还能如何了解该程序的用途？
更新：
在 IGOR 提出很好的建议后，我使用不同的程序反汇编了代码。然而，仍然有一些不好的指令：
e: 88 0c mov BYTE PTR [si],cl
10: 0c fe or al,0xfe
12: c1 (bad)
13: 75 f9 jne 0xe
......
......
96: 90 nop
97: e8 9d ff call 0x37
9a: ff (bad)
9b: ff 41 41 inc WORD PTR [bx+di+0x41]
- 你知道为什么它说
(bad)吗？
I have a short set of machine instructions (160 bytes), and I dont know what it does.
Im on a mac and I ran it under a GDB dissasembler and it came out with this:
....f3c0: jmp 0x7fff5fbff3c6
....f3c2: scas %es:(%rdi),%eax
....f3c3: retq $0xa3bf
....f3c6: sub $0x100,%esp
....f3cc: xor %ecx,%ecx
....f3ce: mov %cl,(%rsp,%rcx,1)
+ 50 more lines....
I know very little assembler, but some of the commands looked funny ( like rex.RXB, rex.WB, rex.B). So after a bit of googling I found this command which told me it was a DOS executable:
$ file program
program: DOS executable (COM)
- Is there a program that can disassemble a DOS executable?
If not, I will try to disassemble it manually since there is only 160 bytes. However I will need a reference of what each bytes means. E.g.
90 = NOP
8a = MOV
....
Is there a reference like this for DOS machine code instructions?
How else might I find out what the program does?
Update:
After a great suggestion from IGOR I disassembled the code using a different program. However, there are still some bad instructions:
e: 88 0c mov BYTE PTR [si],cl
10: 0c fe or al,0xfe
12: c1 (bad)
13: 75 f9 jne 0xe
......
......
96: 90 nop
97: e8 9d ff call 0x37
9a: ff (bad)
9b: ff 41 41 inc WORD PTR [bx+di+0x41]
- Any ideas why its says
(bad)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果它是 COM 文件，那么它只是原始实模式 x86 代码。您可以告诉 objdump 使用 8086 模式，例如：
要查看 Intel 风格的助记符（大多数 Intel 和 DOS 文档使用），请添加“
-M intel”。有关说明参考，请尝试此或此。
If it's a COM file, then it's just raw real-mode x86 code. You can tell objdump to use 8086 mode, e.g.:
To see Intel-style mnemonics (used by most of Intel and DOS documentation), add "
-M intel".For the instruction reference, try this or this.
您可以通过 DOS 调试器在 DOS 机器上运行它。不过，如果它是在构建时考虑到防御这一点的话，可能会非常神秘。
You can run it on a DOS machine through the DOS debugger. Might be quite cryptic though, if it's been built with defence against that in mind.
如果你足够勇敢，你可以尝试安装 DOSBox 并运行它！
If you're brave, you could try installing DOSBox and just run it!
不要假设您看到的所有内容都是指令，它可能只是数据，而它前面看起来像真实指令的指令也可能只是数据。它是一个可变字长指令集，因此无论如何反汇编都很困难。模拟可能是最简单的方法或两者的结合。不要等到得到彻底的拆卸才开始分析，采取几种不同的拆卸方式，只要您能轻松获得工具即可进行尽可能多的拆卸。无论如何，您可能必须手动进行一些操作，这是指导野兽的本性像这样的设置。
google pcemu 找到一个支持 dos 调用的 8086/88 模拟器，等等。Pcemu 本身很容易深入研究并在执行时转储指令等。然后按照反汇编转储，看看它是否有意义。如果没有，也许你需要自己做反汇编程序。
如果这段代码最初是用汇编语言以外的语言编写的，那么它可能很难理解，特别是如果您不了解汇编语言。如果您将此作为汇编中的学习练习，那么还有许多其他更好的学习方法。诚然，为指令集编写反汇编器（或模拟器）是学习指令集的绝佳方法，但可变字长指令是先进的，因为您必须按照执行顺序，而不是线性地通过内存来查找指令，然后再遍历线性地分解你所检测到的指令并留下其余数据。最好先尝试一下像 msp430 这样简单得多的东西，然后再攻击像 x86 这样痛苦的东西。获得 8088/86 反汇编器的快速而肮脏的方法是采用 pcemu 之类的东西并向其中添加 printfs 并按执行顺序反汇编，从分析角度来看，这正是您感兴趣的（我假设）。
Dont assume that everything you see is an instruction, it could just be data and the instructions that preceed it that look like real instructions could just be data. It is a variable word length instruction set so disassembly is difficult anyway. Simulation might be the easiest way or a combination of the two. Dont wait to start your analysis until you get a clean disassembly, take several different disassemblies, as many as you can easily get tools for and just dig in. You might have to do some by hand anyway, its the nature of the beast for instruction sets like this one.
google pcemu to find an emulator for 8086/88 with dos call support, etc. Pcemu itself is easy to dig into and have it dump instructions as they execute, etc. Then follow the disassembly dumps you have to see if it is making sense. If not maybe you need to do your own disassembler.
if this code was originally written in something other than assembler then it may be tough to follow, esp if you dont know the assembly language. if you are doing this as a learning exercise in assembly there are many other better ways to learn. Granted writing a diassembler (or emulator) for an instruction set is an excellent way to learn an instruction set, variable word length instructions though are advanced as you have to go in execution order not linearly through memory to find the instructions, then later go through linearly and disassemble what you have detected as instructions and leave the rest data. It might be better to get your feet wet with something much simpler like the msp430 then attack something as painful as x86. The quick and dirty way to get a disassembler for 8088/86 would be to take something like pcemu and add printfs to it and disassemble in execution order, which is what you are interested in anyway from an analysis perspective (I assume).