{"id":101372,"date":"2021-09-01T09:27:12","date_gmt":"2021-09-01T01:27:12","guid":{"rendered":"https:\/\/www.keaglegz.com\/101372.html"},"modified":"2021-09-01T09:27:12","modified_gmt":"2021-09-01T01:27:12","slug":"ida-sp-analysis-failed%e4%b8%8d%e8%83%bdf5%e7%9a%84%e8%a7%a3%e5%86%b3%e6%96%b9%e6%a1%88","status":"publish","type":"post","link":"https:\/\/www.dongwubaike.cn\/fanhao\/101372.html","title":{"rendered":"IDA sp-analysis failed\u4e0d\u80fdF5\u7684\u89e3\u51b3\u65b9\u6848"},"content":{"rendered":"\n

\u6709\u65f6\u5019\u7528IDA F5\u7684\u65f6\u5019\u9047\u5230\u5e26sp-analysis failed \u7684\u51fd\u6570\u4f1a\u5931\u8d25.
\u8fd9\u53ea\u662f\u4e00\u4e2a\u6781\u5176\u7b80\u5355\u7684\u4e00\u4e2a\u4f8b\u5b50.\u5e0c\u671b\u5927\u5bb6\u80fd\u4f9d\u6b64\u7c7b\u63a8.\u4e5f\u66f4\u5e0c\u671b\u5927\u5bb6\u628a\u7c7b\u4f3c\u7684\u4ee3\u7801\u653e\u51fa\u6765\u4e00\u8d77\u89e3\u51b3\u3002\u539f\u672c\u662f\u4e00\u670b\u53cb\u95ee\u6211\u7684,\u6211\u53ea\u662f\u987a\u4fbf\u53d1\u51fa\u6765.\u4ee5\u540e\u9047\u5230\u7c7b\u4f3c\u60c5\u51b5\u767e\u5ea6\u5c31\u53ef\u4ee5\u627e\u5230\u4e86\u3002<\/p>\n

\u65b9\u6cd5\u4e00<\/h2>\n
  .text:004015ED sub_4015ED      proc near               ; CODE XREF: sub_40116A+1A6p  .text:004015ED                                         ; sub_40116A+1C7p  .text:004015ED  .text:004015ED var_C           = byte ptr -0Ch  .text:004015ED var_8           = dword ptr -8  .text:004015ED var_4           = dword ptr -4  .text:004015ED arg_0           = dword ptr  10h  .text:004015ED  .text:004015ED                 push    ecx  .text:004015EE                 push    esi  .text:004015EF                 push    ebp  .text:004015F0                 mov     ebp, esp  .text:004015F2                 add     esp, 0FFFFFFF8h  .text:004015F5                 mov     ebx, offset String  .text:004015FA                 cmp     dword ptr [ebx], 0FFFFFFFFh  .text:004015FD                 jz      short loc_401606  .text:004015FF                 mov     eax, offset loc_401607  .text:00401604                 jmp     eax  .text:00401606 ; ---------------------------------------------------------------------------  .text:00401606  .text:00401606 loc_401606:                             ; CODE XREF: sub_4015ED+10j  .text:00401606                 nop  .text:00401607  .text:00401607 loc_401607:                             ; DATA XREF: sub_4015ED+12o  .text:00401607                 xor     eax, eax  .text:00401609                 mov     esi, [ebp+arg_0]  .text:0040160C                 mov     al, [esi+ebx]  .text:0040160F                 xor     ebx, ebx  .text:00401611                 push    eax  .text:00401612                 call    sub_4014BF  .text:00401617                 mov     [ebp+var_4], ebx  .text:0040161A                 call    sub_4014D5  .text:0040161F                 mov     [ebp+var_8], ebx  .text:00401622                 push    0  .text:00401624                 push    offset dword_403425  .text:00401629                 push    [ebp+var_4]  .text:0040162C                 push    [ebp+var_8]  .text:0040162F                 call    sub_401561  .text:00401634                 mov     eax, dword_403425  .text:00401639                 ror     eax, 8  .text:0040163C                 cmp     eax, 5  .text:0040163F                 jz      short loc_401649  .text:00401641                 push    eax  .text:00401642                 mov     eax, offset loc_40164A  .text:00401647                 jmp     eax  .text:00401649 ; ---------------------------------------------------------------------------  .text:00401649  .text:00401649 loc_401649:                             ; CODE XREF: sub_4015ED+52j  .text:00401649                 nop  .text:0040164A  .text:0040164A loc_40164A:                             ; DATA XREF: sub_4015ED+55o  .text:0040164A                 pop     eax  .text:0040164B                 xor     ah, [ebp+var_C]  .text:0040164E                 xor     al, [ebp+var_C]  .text:00401651                 xor     edx, edx  .text:00401653                 mov     bx, ax  .text:00401656                 mov     ecx, 4  .text:0040165B  .text:0040165B loc_40165B:                             ; CODE XREF: sub_4015ED+83j  .text:0040165B                 and     al, 0Fh  .text:0040165D                 cmp     al, 9  .text:0040165F                 jle     short loc_401663  .text:00401661                 add     al, 7  .text:00401663  .text:00401663 loc_401663:                             ; CODE XREF: sub_4015ED+72j  .text:00401663                 add     al, 30h  .text:00401665                 mov     dl, al  .text:00401667                 ror     edx, 8  .text:0040166A                 shr     bx, 4  .text:0040166E                 mov     al, bl  .text:00401670                 loop    loc_40165B  .text:00401672                 add     esp, 1Ch  .text:00401675                 pop     ebp  .text:00401676                 pop     esi  .text:00401677                 pop     ecx  .text:00401678                 retn  .text:00401678 [COLOR=\"Red\"]sub_4015ED      endp ; sp-analysis failed[\/COLOR]  <\/pre>\n
\u5e9f\u8bdd\u6211\u5c31\u4e0d\u591a\u8bf4\u4e86,\u9020\u6210\u4e0d\u80fdF5\u7684\u539f\u56e0\u5728\u4e8e\uff1a<\/p>\n
  .text:00401642                 mov     eax, offset loc_40164A  .text:00401647                 jmp     eax  <\/pre>\n
\u7528OD\u6253\u5f00\u4e4b\u540e\u6539\u6389\u4ee3\u7801\u5728\u4fdd\u5b58,\u7136\u540e\u91cd\u65b0\u7528IDA\u6253\u5f00F5\u5c31\u53ef\u4ee5\u4e86,sp-analysis failed\u4e5f\u5c31\u6d88\u5931\u4e86.
 \u5728OD\u91cc\u76f4\u63a5\u6539\u6210JMP 40164A<\/code>
 \u5206\u6790\u4e4b\u540e\u4e0d\u96be\u53d1\u73b0\u4e0d\u80fdF5\u7684\u539f\u56e0,\u5c31\u5728\u4e8e\u8df3\u8f6c.
 \u4e00\u4e2a\u51fd\u6570\u91cc\u9762\u7684\u4e00\u4e2a\u8df3\u8f6c\u5728\u672a\u77e5\u7684\u60c5\u51b5\u4e0b\u4f1a\u51fa\u73b0\u4e0d\u80fdF5.
 \u7ed3\u679c\uff1a<\/p>\n
  char __cdecl sub_4015ED(int a1)  {    unsigned __int16 v1; \/\/ ax@1    int v2; \/\/ edx@1    signed int v3; \/\/ ecx@1    unsigned __int16 v4; \/\/ bx@1    char v5; \/\/ ST10_1@1    int v6; \/\/ eax@1    char v7; \/\/ ST10_1@1    char v8; \/\/ al@2      sub_4014BF(String[a1]);    sub_4014D5(v5);    sub_401561(0, 0, &dword_403425, 0);    v6 = __ROR__(dword_403425, 8);    HIBYTE(v1) = v7 ^ BYTE1(v6);    LOBYTE(v1) = v7 ^ v1;    v2 = 0;    v4 = v1;    v3 = 4;    do    {      v8 = v1 & 0xF;      if ( v8 > 9 )        v8 += 7;      LOBYTE(v2) = v1 + 48;      v2 = __ROR__(v2, 8);      v4 >>= 4;      LOBYTE(v1) = v4;      --v3;    }    while ( v3 );    return v1;  }  <\/pre>\n
\u65b9\u6cd5\u4e8c<\/h2>\n
\"IDA<\/a>
 \u4ee3\u7801\u662f\u7ea2\u8272\u7684,\u5c31\u662f\u8bf4IDA\u6ca1\u6709\u5206\u6790\u51fa\u6765,\u4e3a\u4e86\u65b9\u4fbf\u5206\u6790,\u6211\u4eec\u4f1a\u7528\u5feb\u6377\u952eP(Create Function) \u6765\u521b\u5efa\u51fd\u6570.\u53ea\u662f\u6211\u4eec\u5728\u51fd\u6570\u5934\u90e8\u6309P\u7684\u65f6\u5019\u603b\u4f1a\u63d0\u793a<\/p>\n
     The function has undefined instruction\/data at the specified address.
     Your request has been put in the autoanalysis queue.<\/ol>\n
    \u5927\u5bb6\u6ce8\u610fretn<\/code>\u540e\u9762\u4e24\u884c\u591a\u4f59\u7684\u4ee3\u7801,\u8fd9\u662f\u7f6a\u9b41\u7978\u9996.\u5982\u679c\u6211\u4eec\u4e0d\u80fd\u521b\u5efa\u51fd\u6570,\u5c31\u4e0d\u80fd\u4f7f\u7528F5\u6765\u5206\u6790\u4ee3\u7801\u4e86,\u60f3\u8ba9\u8fd9\u4e9b\u4ee3\u7801\u53d8\u7eff\u8272\u7684\u65b9\u6cd5(\u521b\u5efa\u51fd\u6570)\u5f88\u7b80\u5355.
     \u7528\u9f20\u6807\u4ece\u51fd\u6570\u5934\u90e8\u5f00\u59cb\u5230retn<\/code>\u7ed3\u5c3e \u62d6\u4e00\u4e0b,\u53d8\u6210\u7070\u8272.
         \"IDA<\/a>
     \u7136\u540e\u7528\u5feb\u6377\u952eP<\/code>\u6216\u8005\u53f3\u952e\u83dc\u5355,CreateFunction<\/code>\u6765\u521b\u5efa\u51fd\u6570\u5c31\u53ef\u4ee5\u4e86\u3002
     \u7528\u62d6\u7684\u65b9\u6cd5,\u53bb\u521b\u5efa\u4e00\u4e2a\u51fd\u6570\u7684\u597d\u5904\u662f,\u6211\u4eec\u53ef\u4ee5\u9009\u62e9\u4efb\u610f\u7684\u4e00\u90e8\u5206IDA\u5206\u6790\u4e0d\u51fa\u6765\u7684\u4ee3\u7801(\u5c31\u662f\u7ea2\u8272\u4ee3\u7801),\u6210\u4e3a\u4e00\u4e2a\u7eff\u8272\u7684\u4ee3\u7801(IDA\u53ef\u8bc6\u522b\u7684\u4ee3\u7801).
     \u5f53\u7136\u4e86,\u5230\u8fd9\u91cc\u4e5f\u4e0d\u7b97\u5b8c.\u4e0b\u56fe\u662f\u4ee3\u7801\u53d8\u7eff\u8272\u7684,\u6211\u7528\u4e0a\u9762\u7684\u65b9\u6cd5\u521b\u5efa\u51fd\u6570\u4e86,\u53ef\u8fd8\u662f\u4e0d\u80fdF5.
         \"IDA<\/a>
     \u6211\u4eec\u901a\u8fc7Stack Pointer<\/code>\u53d1\u73b0\u8fd9\u4e2a\u51fd\u6570\u7684\u5806\u6808\u662f\u4e0d\u5e73\u8861\u7684.\u6b64\u65f6\u6211\u4eec\u9700\u8981\u627e\u63a5\u8fd1retn<\/code>\u7684 \u6700\u540e\u4e00\u4e2aCall<\/code>\u7136\u540e\u53bb\u4fee\u6b63\u5806\u6808.
         \"IDA<\/a>
     \u6211\u4eec\u770b\u5230retn<\/code>\u5de6\u8fb9\u7eff\u8272\u7684\u6570\u5b57\u662f28,\u6211\u4eec\u901a\u8fc7ALT + k<\/code>\u4fee\u6b63\u5806\u6808,\u628a28 retn<\/code>\u6539\u62100<\/code>\u5c31\u53ef\u4ee5\u4e86\u3002
     \u4fee\u6b63\u5806\u6808\u7684\u65f6\u5019\u4e00\u5b9a\u8981\u9009\u62e9Call<\/code>\u7136\u540e\u4fee\u6b63\u5806\u6808,\u4e0b\u56fe\u662f\u4fee\u6b63\u540e\u7684\u4ee3\u7801
         \"IDA<\/a>
     \u5f88\u7b80\u5355\u7684\u4e00\u4e2a\u4e1c\u897f,\u7bc7\u5e45\u6709\u70b9\u5927\u4e86,\u53ef\u80fd\u5b58\u5728\u4e00\u4e9b\u95ee\u9898,\u4e0d\u8fc7\u76ee\u7684\u662f\u53ef\u4ee5F5\u5c31\u597d\u4e86.<\/p>\n","protected":false},"excerpt":{"rendered":"
    \u6709\u65f6\u5019\u7528IDA F5\u7684\u65f6\u5019\u9047\u5230\u5e26sp-analysis failed \u7684\u51fd\u6570\u4f1a\u5931\u8d25.
    \n \u8fd9\u53ea\u662f\u4e00\u4e2a\u6781\u5176\u7b80\u5355\u7684\u4e00\u4e2a\u4f8b\u5b50.\u5e0c\u671b\u5927\u5bb6\u80fd\u4f9d\u6b64\u7c7b\u63a8.\u4e5f\u66f4\u5e0c\u671b\u5927\u5bb6\u628a\u7c7b\u4f3c\u7684\u4ee3\u7801\u653e\u51fa\u6765\u4e00\u8d77\u89e3\u51b3\u3002\u539f\u672c\u662f\u4e00\u670b\u53cb\u95ee\u6211\u7684,\u6211\u53ea\u662f\u987a\u4fbf\u53d1\u51fa\u6765.\u4ee5\u540e\u9047\u5230\u7c7b\u4f3c\u60c5\u51b5\u767e\u5ea6\u5c31\u53ef\u4ee5\u627e\u5230\u4e86\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-101372","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts\/101372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/comments?post=101372"}],"version-history":[{"count":0,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts\/101372\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/media?parent=101372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/categories?post=101372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/tags?post=101372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}