c++反汇编逆向还原代码冒泡排序--双层for循环
一、汇编
流程图片太大，分成两部分
需要了解的汇编指令如下
mov ：将源操作数复制到目的操作数
lea ：与mov类似
mov a，b 表示将b赋值给a 若是 mov a，[b] 这是将b的地址赋值给a，相当于指针
jmp 跳转指令
cmp ：比较
jg ： jle 前面>后面
push：压栈
点我跳转——c++反汇编逆向还原指令jge jg jle jl jne je
关于数组以及其元素选择的还原看在下面的文章
C++反汇编逆向还原——数组与循环还原练习(笔记)
完整冒泡排序汇编
.text:00411BEE __$EncStackInitEnd_3:
.text:00411BEE mov eax, ___security_cookie
.text:00411BF3 xor eax, ebp
.text:00411BF5 mov [ebp+var_4], eax
.text:00411BF8 mov ecx, offset _30BB0303_Project2@cpp ; JMC_flag
.text:00411BFD call j_@__CheckForDebuggerJustMyCode@4 ; __CheckForDebuggerJustMyCode(x)
.text:00411C02 mov [ebp+n], 0
.text:00411C09 lea eax, [ebp+n]
.text:00411C0C push eax
.text:00411C0D push offset _Format ; "%d"
.text:00411C12 call j__scanf_s
.text:00411C17 add esp, 8
.text:00411C1A mov [ebp+i], 0
.text:00411C24 jmp short loc_411C35
.text:00411C26 ; ---------------------------------------------------------------------------
.text:00411C26
.text:00411C26 loc_411C26: ; CODE XREF: _main+8B↓j
.text:00411C26 mov eax, [ebp+i]
.text:00411C2C add eax, 1
.text:00411C2F mov [ebp+i], eax
.text:00411C35
.text:00411C35 loc_411C35: ; CODE XREF: _main+54↑j
.text:00411C35 mov eax, [ebp+i]
.text:00411C3B cmp eax, [ebp+n]
.text:00411C3E jge short loc_411C5D
.text:00411C40 mov eax, [ebp+i]
.text:00411C46 lea ecx, [ebp+eax*4+arr]
.text:00411C4D push ecx
.text:00411C4E push offset _Format ; "%d"
.text:00411C53 call j__scanf_s
.text:00411C58 add esp, 8
.text:00411C5B jmp short loc_411C26
.text:00411C5D ; ---------------------------------------------------------------------------
.text:00411C5D
.text:00411C5D loc_411C5D: ; CODE XREF: _main+6E↑j
.text:00411C5D mov [ebp+var_1BC], 0
.text:00411C67 jmp short loc_411C78
.text:00411C69 ; ---------------------------------------------------------------------------
.text:00411C69
.text:00411C69 loc_411C69: ; CODE XREF: _main:loc_411D0D↓j
.text:00411C69 mov eax, [ebp+var_1BC]
.text:00411C6F add eax, 1
.text:00411C72 mov [ebp+var_1BC], eax
.text:00411C78
.text:00411C78 loc_411C78: ; CODE XREF: _main+97↑j
.text:00411C78 mov eax, [ebp+var_1BC]
.text:00411C7E cmp eax, [ebp+n]
.text:00411C81 jge loc_411D12
.text:00411C87 mov eax, [ebp+var_1BC]
.text:00411C8D mov [ebp+j], eax
.text:00411C93 jmp short loc_411CA4
.text:00411C95 ; ---------------------------------------------------------------------------
.text:00411C95
.text:00411C95 loc_411C95: ; CODE XREF: _main:loc_411D0B↓j
.text:00411C95 mov eax, [ebp+j]
.text:00411C9B add eax, 1
.text:00411C9E mov [ebp+j], eax
.text:00411CA4
.text:00411CA4 loc_411CA4: ; CODE XREF: _main+C3↑j
.text:00411CA4 mov eax, [ebp+j]
.text:00411CAA cmp eax, [ebp+n]
.text:00411CAD jge short loc_411D0D
.text:00411CAF mov eax, [ebp+var_1BC]
.text:00411CB5 mov ecx, [ebp+eax*4+arr]
.text:00411CBC mov [ebp+tmp], ecx
.text:00411CC2 mov eax, [ebp+var_1BC]
.text:00411CC8 mov ecx, [ebp+j]
.text:00411CCE mov edx, [ebp+eax*4+arr]
.text:00411CD5 cmp edx, [ebp+ecx*4+arr]
.text:00411CDC jle short loc_411D0B
.text:00411CDE mov eax, [ebp+var_1BC]
.text:00411CE4 mov ecx, [ebp+j]
.text:00411CEA mov edx, [ebp+ecx*4+arr]
.text:00411CF1 mov [ebp+eax*4+arr], edx
.text:00411CF8 mov eax, [ebp+j]
.text:00411CFE mov ecx, [ebp+tmp]
.text:00411D04 mov [ebp+eax*4+arr], ecx
.text:00411D0B
.text:00411D0B loc_411D0B: ; CODE XREF: _main+10C↑j
.text:00411D0B jmp short loc_411C95
.text:00411D0D ; ---------------------------------------------------------------------------
.text:00411D0D
.text:00411D0D loc_411D0D: ; CODE XREF: _main+DD↑j
.text:00411D0D jmp loc_411C69
.text:00411D12 ; ---------------------------------------------------------------------------
.text:00411D12
.text:00411D12 loc_411D12: ; CODE XREF: _main+B1↑j
.text:00411D12 mov [ebp+var_1E0], 0
.text:00411D1C jmp short loc_411D2D
.text:00411D1E ; ---------------------------------------------------------------------------
.text:00411D1E
.text:00411D1E loc_411D1E: ; CODE XREF: _main+183↓j
.text:00411D1E mov eax, [ebp+var_1E0]
.text:00411D24 add eax, 1
.text:00411D27 mov [ebp+var_1E0], eax
.text:00411D2D
.text:00411D2D loc_411D2D: ; CODE XREF: _main+14C↑j
.text:00411D2D mov eax, [ebp+var_1E0]
.text:00411D33 cmp eax, [ebp+n]
.text:00411D36 jge short loc_411D55
.text:00411D38 mov eax, [ebp+var_1E0]
.text:00411D3E mov ecx, [ebp+eax*4+arr]
.text:00411D45 push ecx
.text:00411D46 push offset aD ; "%d "
.text:00411D4B call j__printf
.text:00411D50 add esp, 8
.text:00411D53 jmp short loc_411D1E
.text:00411D55 ; ---------------------------------------------------------------------------
.text:00411D55
.text:00411D55 loc_411D55: ; CODE XREF: _main+166↑j
.text:00411D55 xor eax, eax
.text:00411D57 push edx
.text:00411D58 mov ecx, ebp ; frame
.text:00411D5A push eax
.text:00411D5B lea edx, v ; v
.text:00411D61 call j_@_RTC_CheckStackVars@8 ; _RTC_CheckStackVars(x,x)
.text:00411D66 pop eax
.text:00411D67 pop edx
.text:00411D68 pop edi
.text:00411D69 pop esi
.text:00411D6A pop ebx
.text:00411D6B mov ecx, [ebp+var_4]
.text:00411D6E xor ecx, ebp ; cookie
.text:00411D70 call j_@__security_check_cookie@4 ; __security_check_cookie(x)
.text:00411D75 add esp, 2A4h
.text:00411D7B cmp ebp, esp
.text:00411D7D call j___RTC_CheckEsp
.text:00411D82 mov esp, ebp
.text:00411D84 pop ebp
.text:00411D85 retn
.text:00411D85 ; ---------------------------------------------------------------------------
.text:00411D86 align 4
.text:00411D88 ; _RTC_framedesc v
.text:00411D88 v _RTC_framedesc <2, offset dword_411D90>
.text:00411D88 ; DATA XREF: _main+18B↑o
.text:00411D90 dword_411D90 dd 0FFFFFFF4h, 4 ; DATA XREF: _main:v↑o
.text:00411D98 dd offset dword_411DAC
.text:00411D9C dd 0FFFFFE5Ch, 190h
.text:00411DA4 dd offset dword_411DA8
.text:00411DA8 dword_411DA8 dd 727261h ; DATA XREF: _main+1D4↑o
.text:00411DAC dword_411DAC dd 0CCCC006Eh, 20h dup(0CCCCCCCCh)
.text:00411DAC ; DATA XREF: _main+1C8↑o
.text:00411DAC _main endp二、代码还原
原原本本按照汇编还原
#include<stdio.h>
int main(){int ebp_n=0;scanf("%d",&ebp_n);int arr[100];int ebp_i=0;for(;ebp_i<ebp_n;){int eax=ebp_i;scanf("%d",&arr[eax]);eax=ebp_i;eax=eax+1;ebp_i=eax;}int ebp_var_1BC=0;for(;ebp_var_1BC<ebp_n;){int eax=ebp_var_1BC;int ebp_j=eax;for(;ebp_j<ebp_n;){eax=ebp_var_1BC;int ecx=arr[eax];int ebp_tmp=ecx;eax=ebp_var_1BC;ecx=ebp_j;int edx=arr[eax]; if(arr[eax]>arr[ecx]){eax=ebp_var_1BC;ecx=ebp_j;arr[eax]=arr[ecx];eax=ebp_j;ecx=ebp_tmp;arr[eax]=ecx;}ebp_j+=1;}eax=ebp_var_1BC;eax+=1;ebp_var_1BC=eax;}int ebp_var_1E0=0;for(;ebp_var_1E0<ebp_n;){int eax=ebp_var_1E0;int ecx=arr[eax];printf("%d ",ecx);eax=ebp_var_1E0;eax+=1;ebp_var_1E0=eax;}return 0;
} 整理后的代码
#include<stdio.h>
int main(){int ebp_n=0;scanf("%d",&ebp_n);int arr[100];for(int ebp_i=0;ebp_i<ebp_n;ebp_i++){int eax=ebp_i;scanf("%d",&arr[eax]);}for(int ebp_i=0;ebp_i<ebp_n;ebp_i++){for(int ebp_j=ebp_i;ebp_j<ebp_n;ebp_j++){int ebp_tmp=arr[ebp_i]; if(arr[ebp_i]>arr[ebp_j]){arr[ebp_i]=arr[ebp_j];arr[ebp_j]=ebp_tmp;}}}for(int ebp_var_1E0=0;ebp_var_1E0<ebp_n;ebp_var_1E0++){int eax=ebp_var_1E0;int ecx=arr[eax];printf("%d ",ecx);}return 0;
} 结果
三、源代码
输入n个数，对这些数进行冒泡排序
#include<iostream>
using namespace std;
int main(){int n = 0;scanf_s("%d", &n);int arr[100];for (int i = 0; i < n; i++) {scanf_s("%d", &arr[i]);}for (int i = 0; i < n; i++) {for (int j = i; j < n; j++) {int tmp = arr[i];if (arr[i] > arr[j]) {arr[i] = arr[j];arr[j] = tmp;}}}for (int i = 0; i < n; i++) {printf("%d ", arr[i]);}return 0;
}源代码运行结果
