![]() |
|
#1
|
|||
|
|||
|
I have seen the article about ntdll!RtlFillMemoryUlong Reserver,Follow article:
Use IDA Pro Reserver En XP SP1 ntdll!RtlFillMemoryUlong: ; __stdcall RtlFillMemoryUlong(x,x,x) public _RtlFillMemoryUlong@12 _RtlFillMemoryUlong@12 proc near dest= dword ptr 8 bytecount= dword ptr 0Ch value= dword ptr 10h push edi mov edi, [esp+dest] mov ecx, [esp+bytecount] mov eax, [esp+value] shr ecx, 2 ; bytecount / 4 rep stosd pop edi retn 0Ch _RtlFillMemoryUlong@12 endp -------------------------------------------------------------------------- Below is C: -------------------------------------------------------------------------- VOID NTAPI RtlFillMemoryUlong ( PULONG dest, //EBP+0x008] DWORD bytecount, // EBP+0x00C] ULONG value // EBP+0x010] ) { bytecount /= 4; while ( bytecount-- ) { *dest++ = value; } /* end of while */ return; } /* end of RtlFillMemoryUlong */ -------------------------------------------------------------------------- Becasue it is easy,I can understand that,But it will not give the Analyse How do that and why do that ,someone can give me articles like that ??? I need the analyse!!Please Help Me! |
|
|