请教下各位,已知一段十六进制代码,能否有办法直接运行?

Question

如题所问.
十六进制代码如下:unsigned long aa[]={0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x284440,0x487C58,0x1400,0x102800,0x2010,0x82010,0x82010,0x204C28,0x102800,0x101C00,0x385868,0x1420,0x5890A8,0x183C20,0x204838,0x285038,0x285038,0x285038,0x204428,0x285038,0x285038,0x285038,0x204C28,0x205C40,0x204C28,0x205C40,0x204C28,0x285038,0x204838,0x285038,0x285038,0x285038,0x285038,0x205C60,0x0,0x386868,0x406C78,0x287450,0x183C20,0x1400,0xC00,0x101C00,0x101C00,0x101C00,0x202C08,0x80C08,0x181008,0x181410,0x181810,0x282018,0x302020,0x302020,0x302020,0x302020,0x302020,0x302020,0x302020,0x302020};
这段十六进制代码到底代表了什么意思?
拜谢!

Answer 1

当然可以，水平高点自己构造pe
想我这样水平差点的就弄个exe自己修改，以前试成功过，随便修改了exe里面的几个字节，运行后系统莫名其妙多了一些畸形文件夹，怎么都删不了，后来格盘才消失了

Answer 2

_asm
{
    push offset aa
    ret
}不过你这个代码，开头那一大段“0”看着就没实质意义，可能夹杂了花指令在里面。

Answer 3

需要查机器指令对应的汇编码如果只是执行，可以用FlushInstructionCache，但后果不可预知。

Answer 4

// runcode.cpp : Defines the entry point for the console application.
//#include "stdafx.h"
#include "string.h"int aaaa;void p( void )
{
aaaa = 0x1234;
}// 这是一段函数P的汇编代码，简单的可以做，复杂的则出错
unsigned char q[ 0x100 ] =
{
0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x40, 0x53, 0x56, 0x57, 0x8D, 0x7D, 0xC0, 0xB9, 0x10, 0x00, 0x00,
0x00, 0xB8, 0xCC, 0xCC, 0xCC, 0xCC, 0xF3, 0xAB, 0xC7, 0x05, 0x44, 0x3B, 0x42, 0x00, 0x88, 0x88,
0x00, 0x00, 0x5F, 0x5E, 0x5B, 0x8B, 0xE5, 0x5D, 0xC3, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC,
};typedef void( *myfun )( void );int main(int argc, char* argv[])
{
myfun a = ( myfun )( ( void * )q ); p(); printf( "aaaa = 0x%.X after function p\r\n", aaaa ); a(); printf( "aaaa = 0x%.X after array code q\r\n", aaaa ); return 0;
}写了一个简单的代码，以前见过一个复杂的，找不到了，这个简单的可以帮助理解，但是对于楼主的例子可能并不适用。