从数据段调用函数
我想对root-me.org（pe x86格式）进行“ xormadness.exe”可执行文件进行逆向工程分析，但是我不明白为什么从数据段调用函数，以及我们如何知道哪个功能函数被调用。
.text:0040105e ff 15 0c 20 40 00 call DWORD PTR ds:0x40200c
在这里，我可以看到已经完成了函数调用，但是我不明白为什么使用数据段。
.rdata:0040200c 80 0x80
此外，此地址与函数无关，只有一个0x80字节值，我不明白这一点。
I would like to do a reverse engineering analysis of the "xormadness.exe" executable file from root-me.org (PE x86 format), but i don't understand why functions are called from the data segment and how do we know which function is called.
.text:0040105e ff 15 0c 20 40 00 call DWORD PTR ds:0x40200c
Here, i can see that a function call is done, but i don't understand why the data segment is used.
.rdata:0040200c 80 0x80
Furthermore, this address have nothing to do with a function, there is only a 0x80 byte value and i don't understand this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这是一个间接函数调用，如
dword ptr令牌序列所证明的。该功能地址是从地址0x40200C的DWORD获取的，然后对该函数进行调用。ds：段前缀是红鲱鱼。这正是直接解决内存操作数默认为段的段。由于您可能是为平面内存模型编程，因此您可以忽略这一点。This is an indirect function call as evidenced by the
DWORD PTRtoken sequence. The function address is fetched from a dword at address0x40200cand then a call is performed to that function.The
ds:segment prefix is a red herring. This is just what segment a directly addressed memory operand defaults to. As you are probably programming for a flat memory model, you can ignore this.