void __declspec(naked) MoveInner(DWORD)
{
__asm
{
push ebp
mov ebp, esp
push -1
push 0x007B0481
mov eax, dword ptr fs:[0]
push eax
mov dword ptr fs:[0], esp
sub esp, 0x0E58
push ebx
push esi
push edi
mov ebx, ecx
lea edx, dword ptr [ebp-0x38]
mov eax, fXPos
mov dword ptr [edx], eax
mov eax, 0x00
mov dword ptr [edx+0x04], eax
mov eax, fYPos
mov dword ptr [edx+0x08], eax
mov ecx, dword ptr [ebx+0x111C]
mov edx, dword ptr [ebx+0x1118]
mov eax, dword ptr [ebx+0x1120]
mov dword ptr [ebp-0x4C], ecx
lea edi, dword ptr [ebx+0x88]
mov dword ptr [ebp-0x50], edx
mov edx, dword ptr [ebx+0x84]
lea ecx, dword ptr [ebx+0x19EC]
mov dword ptr [ebp-0x48], eax
push edi
push ecx
lea eax, dword ptr [ebp-0x38]
push 0x0F
lea eax, fXPos
push eax
lea eax, dword ptr [ebx+0x1118]
push eax
mov ecx, 0x22dd500
mov ecx, dword ptr [ecx]
lea edi, dword ptr [ebx+0x0FA0]
mov byte ptr [edi], 0x01
lea edi, dword ptr [ebx+0x88]
lea esi, dword ptr [ebx+0x0F84]
push dwTestCall
ret
}
}
{
__asm
{
push ebp
mov ebp, esp
push -1
push 0x007B0481
mov eax, dword ptr fs:[0]
push eax
mov dword ptr fs:[0], esp
sub esp, 0x0E58
push ebx
push esi
push edi
mov ebx, ecx
lea edx, dword ptr [ebp-0x38]
mov eax, fXPos
mov dword ptr [edx], eax
mov eax, 0x00
mov dword ptr [edx+0x04], eax
mov eax, fYPos
mov dword ptr [edx+0x08], eax
mov ecx, dword ptr [ebx+0x111C]
mov edx, dword ptr [ebx+0x1118]
mov eax, dword ptr [ebx+0x1120]
mov dword ptr [ebp-0x4C], ecx
lea edi, dword ptr [ebx+0x88]
mov dword ptr [ebp-0x50], edx
mov edx, dword ptr [ebx+0x84]
lea ecx, dword ptr [ebx+0x19EC]
mov dword ptr [ebp-0x48], eax
push edi
push ecx
lea eax, dword ptr [ebp-0x38]
push 0x0F
lea eax, fXPos
push eax
lea eax, dword ptr [ebx+0x1118]
push eax
mov ecx, 0x22dd500
mov ecx, dword ptr [ecx]
lea edi, dword ptr [ebx+0x0FA0]
mov byte ptr [edi], 0x01
lea edi, dword ptr [ebx+0x88]
lea esi, dword ptr [ebx+0x0F84]
push dwTestCall
ret
}
}
这样声明的是不是 moveinner 有一个参数?
dwTestCall又是何须人也,给的代码不全
procedure MoveInner(DWORD)
begin
asm
push ebp
mov ebp, esp
push -1
push 0x007B0481
mov eax, dword ptr fs:[0]
push eax
mov dword ptr fs:[0], esp
sub esp, 0x0E58
push ebx
push esi
push edi
mov ebx, ecx
lea edx, dword ptr [ebp-0x38]
mov eax, fXPos
mov dword ptr [edx], eax
mov eax, 0x00
mov dword ptr [edx+0x04], eax
mov eax, fYPos
mov dword ptr [edx+0x08], eax
mov ecx, dword ptr [ebx+0x111C]
mov edx, dword ptr [ebx+0x1118]
mov eax, dword ptr [ebx+0x1120]
mov dword ptr [ebp-0x4C], ecx
lea edi, dword ptr [ebx+0x88]
mov dword ptr [ebp-0x50], edx
mov edx, dword ptr [ebx+0x84]
lea ecx, dword ptr [ebx+0x19EC]
mov dword ptr [ebp-0x48], eax
push edi
push ecx
lea eax, dword ptr [ebp-0x38]
push 0x0F
lea eax, fXPos
push eax
lea eax, dword ptr [ebx+0x1118]
push eax
mov ecx, 0x22dd500
mov ecx, dword ptr [ecx]
lea edi, dword ptr [ebx+0x0FA0]
mov byte ptr [edi], 0x01
lea edi, dword ptr [ebx+0x88]
lea esi, dword ptr [ebx+0x0F84]
push dwTestCall
ret
end;
end;
还是 procedure MoveInner(Svar:DWORD);?这样?
下面是不是漏了一行
try
var_0x38.ar1 := fXPos;
var_0x38.arg2 := 0
var_0x38.arg3 := fYPos;
var_0x4c := self.arg_0x111c;
var_0x50 := self.arg_0x1118;
var_0x48 := self.arg_0x1120;
self.arg_0x0fa0 := 1;
{obj_0x22dd500.}dwTestCall(self.arg_0x88,self.arg_0f84,@self.arg_0x1118,fXPos,$0f,{@var_0x38,}@self.arg_0x19Ec,@self.arg_0x88);
{var_0x4c,var_0x50,var_0x48
except
{self.}sub_0x007B0481;
end;
lea eax, dword ptr [ebp-0x38]
push 0x0F
lea eax, fXPos 可能是少了push eax
否则lea eax, dword ptr [ebp-0x38]是多余的
那个push 0x0f,不知道是不是pushf,就这么一小段代码,实在看不懂.
老大也说了这是一个带dword参数的procedure 那么上边 moveinner中哪里取出了这个参数?现在困惑我的问题主要是这个特殊的函数声明方式__declspec(naked)
到delphi中嵌入汇编没有这个代替函数,然而我知道可以比这个函数精简许多,因为__declspec(naked)这个方式定义的函数需要自己处理参数的传递所以我希望可以有大侠改成delphi能用的汇编代码,而不是改成delphi代码。 一下是调用上边moveinner函数的代码
procedure MoveByMouse(x,y:integer);stdcall;
begin
asm
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword ptr [ebp+$08]
mov fXPos, eax
mov ecx, dword ptr [ebp+$0C]
mov dword ptr fYPos, ecx
mov dword ptr fZPos, 0
xor edx, edx
test edx, edx
push 2
mov ecx, $00EB38B8
mov eax, $00435DC0
call eax
test eax, eax
je @@lable_quit
mov esi, eax
mov ecx, dword ptr [esi+$08]
push 0
push $78
push 3
call MoveInner
@@lable_quit:
pop edi
pop esi
pop ebx
pop ebp
ret 8
end;
end;MoveByMouse 应该也可以精简很多吧,有没有高手帮忙简化一下?
procedure MoveInner;assembler;
asm
...
end;这个MoveInner应该是MoveByMouse当中的一个内嵌函数