在Assembly中交换两个代码块

Question

我有一个我反编译并想要重写的函数。

这种变化似乎很简单 - 我需要互相替换两大部分代码。在C语言中，它只需要剪切和粘贴。但是在ASM中我遇到了一些困难。尽管跳转指令中的地址是相对的（我已经想到），但修改后的DLL仍然崩溃，而IDA Pro无法解释新代码。我必须在背景中丢失一些东西。请帮我完成任务，因为我是新手。

这是列表：

push    ebp
mov     ebp, esp
sub     esp, 20h
mov     eax, dword ptr _NDFAPI_NULL_THUNK_DATA_DLA-5D1331CCh
xor     eax, ebp
mov     [ebp+var_4], eax
push    ebx
push    esi
push    edi

---------------------------------------------

push    398Eh           ; string_id
push    0C3BEh          ; command_id
mov     ecx, esi        ; this
call    ?AddItemWithStringId@SimpleMenuModel@ui@@QAEXHH@Z ; 
         ui::SimpleMenuModel::AddItemWithStringId(int,int)

push    3990h           ; string_id
push    0C3C0h          ; command_id
mov     ecx, esi        ; this
call    ?AddItemWithStringId@SimpleMenuModel@ui@@QAEXHH@Z ;
         ui::SimpleMenuModel::AddItemWithStringId(int,int) 

push    398Fh           ; string_id
push    0C3BFh          ; command_id
mov     ecx, esi        ; this
call    ?AddItemWithStringId@SimpleMenuModel@ui@@QAEXHH@Z ; 
         ui::SimpleMenuModel::AddItemWithStringId(int,int)

---------------------------------------------

mov     ebx, ecx
call    ?chrome_proxy_header@data_reduction_proxy@@YAPBDXZ ; 

data_reduction_proxy::chrome_proxy_header(void)
push    eax             ; _Ptr
lea     ecx, [ebp+_Keyval] ; this
call    ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z 

; 

std::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string<char,std::char_traits<char>,st

d::allocator<char>>(char const *)
lea     eax, [ebp+_Keyval]
push    eax             ; _Keyval
lea     eax, [ebp+result]
lea     edi, [ebx+3ECh]
push    eax             ; result
mov     ecx, edi        ; this
call    ?find@?$_Tree@V?$_Tmap_traits@V?$basic_string@DU?$char_traits@D@std@@V?

$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?

$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@

$0A@@std@@@std@@QAE?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$basic_string@DU?

$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@std@@@std@@@2@ABV?$basic_string@DU?$char_traits@D@std@@V?

$allocator@D@2@@2@@Z ; 

std::_Tree<std::_Tmap_traits<std::basic_string<char,std::char_traits<char>,std::allocator<char>>,std::basic_stri

ng<char,std::char_traits<char>,std::allocator<char>>,std::less<std::basic_string<char,std::char_traits<char>,std

::allocator<char>>>,std::allocator<std::pair<std::basic_string<char,std::char_traits<char>,std::allocator<char>> 

const,std::basic_string<char,std::char_traits<char>,std::allocator<char>>>>,0>>::find

(std::basic_string<char,std::char_traits<char>,std::allocator<char>> const &)
push    0               ; _Newsize
push    1               ; _Built
lea     ecx, [ebp+_Keyval] ; this
mov     esi, [eax]
call    ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?

$allocator@D@2@@std@@QAEX_NI@Z ; std::basic_string<char,std::char_traits<char>,std::allocator<char>>::_Tidy

(bool,uint)
cmp     esi, [edi]
jz      short loc_6025D46B
call    ?chrome_proxy_lo_fi_directive@data_reduction_proxy@@YAPBDXZ ; 

data_reduction_proxy::chrome_proxy_lo_fi_directive(void)
push    eax             ; _Ptr
lea     ecx, [esi+28h]  ; this
call    ?compare@?$basic_string@DU?$char_traits@D@std@@V?

$allocator@D@2@@std@@QBEHPBD@Z ; std::basic_string<char,std::char_traits<char>,std::allocator<char>>::compare

(char const *)
test    eax, eax
jnz     short loc_6025D46B
push    3993h           ; string_id
push    0C3C4h          ; command_id
lea     ecx, [ebx+400h] ; this
call    ?AddItemWithStringId@SimpleMenuModel@ui@@QAEXHH@Z ; 
         ui::SimpleMenuModel::AddItemWithStringId(int,int)

.text:6025D46B:                           ; CODE XREF: RenderViewContextMenu::AppendImageItems
(void)
.text:6025D46B                                         ; RenderViewContextMenu::AppendImageItems(void)

push    dword ptr [ebx+3FCh] ; context
call    ?

GetForBrowserContext@DataReductionProxyChromeSettingsFactory@@SAPAVDataReductionProxyChromeSettings@@PAVBrowserC

ontext@content@@@Z ; DataReductionProxyChromeSettingsFactory::GetForBrowserContext(content::BrowserContext *)

pop     ecx
test    eax, eax
jz      short loc_6025D499
lea     ecx, [ebx+0F4h]
push    ecx             ; url
mov     ecx, eax        ; this
call     ?CanUseDataReductionProxy@DataReductionProxySettings@data_reduction_proxy@@QBE_NABVGURL@@@Z ; 

data_reduction_proxy::DataReductionProxySettings::CanUseDataReductionProxy(GURL const &)

test    al, al

jz      short loc_6025D499
push    3992h
push    0C3C3h
jmp     short loc_6025D4A3

.text:6025D499                                         ; RenderViewContextMenu::AppendImageItems(void)

push    3991h           ; string_id
push    0C3C1h          ; command_id

.text:6025D4A3 loc_6025D4A3:                           ; CODE XREF: RenderViewContextMenu::AppendImageItems(void)

lea     esi, [ebx+400h]
mov     ecx, esi        ; this
call    ?AddItemWithStringId@SimpleMenuModel@ui@@QAEXHH@Z ; 
         ui::SimpleMenuModel::AddItemWithStringId(int,int)

---------------------------------------------------------------------------

mov     ecx, [ebp+var_4]
pop     edi
pop     esi
xor     ecx, ebp        ; cookie
pop     ebx
call    @__security_check_cookie@4 ; __security_check_cookie(x)
mov     esp, ebp
pop     ebp
retn

我所做的是将程序段从例程的末尾移动到它的开头。我有什么冲动？

Answer 1

移动代码块后的第一行是：

    mov ebx, ecx

这会将this中的ecx参数复制到一个不会被第一个函数调用破坏的寄存器中。您需要将此行移到新代码块上方。整个函数都保持ebx的这个值。

紧接着，你需要这条线

    lea esi, [ebx+400h]

正如你在评论中提到的那样。不要从当前位置删除此行，因为它仍然需要。