在其它怎看到一个让静态变量可以多次初始化的例子,也看明白了,就有一点想不通,程序代码应该是在代码段上的是不可写的,可下面的程序为什么没有修改其属性就可以直接修改,附代码如下:
void Test(int initVal)
{
static int i = initVal;
cout<<sizeof(i)<<endl;
} int FindAddress() { unsigned char *addr = (unsigned char *)&Test; // There is only one instruction in Test: jmp realAddr if (*addr == 0xe9)
{
addr = addr + *(int *)(addr + 1) + 5;
} // Look forward at most 100 bytes for instruction "and eax 1"
for (int i = 0; i < 64; i++)
{
#ifdef WIN32
if (memcmp(addr + i, "\x83\xe0\x01", 3) == 0)
{
return *(int *)(addr + i - 4);
}
#else
if (addr[i+0] == 0x80 && addr[i+1] == 0x3d && addr[i+6] == 0x00)
{
return *(int *)(addr + i + 2);
}
#endif
}
return 0; }
int main()
{
cout <<"before modify: "<<endl;
Test(0);
Test(100);
try
{
int flagAddress = FindAddress();
if (flagAddress)
{
cout << "After modify: " << endl;
*reinterpret_cast <int *>(flagAddress) = 0; //Here :flagAddress是一个代码段的地址,为什么可以直接修改??
Test(1000);
}
else
{
cout << "Can not find the flag address" << endl;
}
}
catch (...)
{
cout << "There is some bug in program" << endl;
} return 0;
}
void Test(int initVal)
{
static int i = initVal;
cout<<sizeof(i)<<endl;
} int FindAddress() { unsigned char *addr = (unsigned char *)&Test; // There is only one instruction in Test: jmp realAddr if (*addr == 0xe9)
{
addr = addr + *(int *)(addr + 1) + 5;
} // Look forward at most 100 bytes for instruction "and eax 1"
for (int i = 0; i < 64; i++)
{
#ifdef WIN32
if (memcmp(addr + i, "\x83\xe0\x01", 3) == 0)
{
return *(int *)(addr + i - 4);
}
#else
if (addr[i+0] == 0x80 && addr[i+1] == 0x3d && addr[i+6] == 0x00)
{
return *(int *)(addr + i + 2);
}
#endif
}
return 0; }
int main()
{
cout <<"before modify: "<<endl;
Test(0);
Test(100);
try
{
int flagAddress = FindAddress();
if (flagAddress)
{
cout << "After modify: " << endl;
*reinterpret_cast <int *>(flagAddress) = 0; //Here :flagAddress是一个代码段的地址,为什么可以直接修改??
Test(1000);
}
else
{
cout << "Can not find the flag address" << endl;
}
}
catch (...)
{
cout << "There is some bug in program" << endl;
} return 0;
}
解决方案 »
- MFC单文档视类选择派生于CRichEditView,创建后打开TXT文件后,显示出来的字符是保存在哪里的?
- 远控里面的显示文件夹他是怎么在本地显示出来的?
- 关于Stingray类库,MenuBar中,动态改变菜单的可能性~?
- 是否所有的含hdc参数的函数所用的坐标是设备坐标还是逻辑坐标,
- (在线等!)抓不到包的原因???
- 用什么方法来区别单服务器和多客户端的数据流呢?
- INSIDE COM 73 页的一个问题: 如何制作MAKEFILE文件阿??
- ________________________类声明问题,内含代码,在线等!
- 串口异步通信问题
- 偶现在想学网络方面的东东, 请大家介绍几本好书, 不胜感激,
- CWnd的前端显示、拖动和缩放
- 请教高手一个菜菜问题
{
static int i = initVal;
cout < < i < < endl;
++i;
}