![]() |
About Reserver
I have seen the article about ntdll!RtlFillMemoryUlong Reserver,Follow article:
Use IDA Pro Reserver En XP SP1 ntdll!RtlFillMemoryUlong: ; __stdcall RtlFillMemoryUlong(x,x,x) public _RtlFillMemoryUlong@12 _RtlFillMemoryUlong@12 proc near dest= dword ptr 8 bytecount= dword ptr 0Ch value= dword ptr 10h push edi mov edi, [esp+dest] mov ecx, [esp+bytecount] mov eax, [esp+value] shr ecx, 2 ; bytecount / 4 rep stosd pop edi retn 0Ch _RtlFillMemoryUlong@12 endp -------------------------------------------------------------------------- Below is C: -------------------------------------------------------------------------- VOID NTAPI RtlFillMemoryUlong ( PULONG dest, //EBP+0x008] DWORD bytecount, // EBP+0x00C] ULONG value // EBP+0x010] ) { bytecount /= 4; while ( bytecount-- ) { *dest++ = value; } /* end of while */ return; } /* end of RtlFillMemoryUlong */ -------------------------------------------------------------------------- Becasue it is easy,I can understand that,But it will not give the Analyse How do that and why do that ,someone can give me articles like that ??? I need the analyse!!Please Help Me! |
| All times are GMT +8. The time now is 13:32. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX