http://d.hatena.ne.jp/rootkit/20080818/1219042285 ãã¹ã50ä½ã®ä¸ãããæä½éããã ãè¦ãã¦ããã°ãã£ã¨è§£æã§ããå½ä»¤ãã¾ã¨ãã¦ã¿ãã é¢æ°å¼ã³åºããEIPå¤æ´é¢é£ã®å½ä»¤ push ã¹ã¿ãã¯ã¸å¤ãæ ¼ç´ pop ã¹ã¿ãã¯ããå¤ãåãåºã call ã¹ã¿ãã¯ã«æ¬¡ã®å®è¡å½ä»¤ã®ã¢ãã¬ã¹ãå
¥ãã¦ã¸ã£ã³ã leave retã®åã«ç½®ããããã®ï¼"mov esp, ebp"ï¼"pop ebp"ã¨åãï¼ ret ã¹ã¿ãã¯ã®ãããã«ããå¤ãåãåºãã¦ããã¸ã¸ã£ã³ã jmp æå®ã¢ãã¬ã¹ã¸ã¸ã£ã³ã å¤ã®æä½ç³»ã®å½ä»¤ mov ã¬ã¸ã¹ã¿å¤ãã¡ã¢ãªã®å¤ã転é movzx 渡ããã¬ã¸ã¹ã¿å¤ãã¡ã¢ãªå¤ã®ãµã¤ãºãç°ã£ã¦ã転éå¯è½ãªmov lea 説æãã«ãããã¾ã[]ã®ä¸ã®è¨ç®çµæãã¬ã¸ã¹ã¿ã¸å
¥ãã¨è¦ãã¦ããã°ãï½ xchg 2ã¤ã®ãªãã©ã³ãã交æããï¼xchg eax,
{{#tags}}- {{label}}
{{/tags}}