Quantcast
Channel: 看雪安全论坛
Viewing all articles
Browse latest Browse all 9556

【求助】菜鸟求助,请高手帮我看下下面的代码。

$
0
0
IDA里面,反编译一个DLL中的一段代码如下,请高手帮我看看。
前面六行我懂, sub_100071B0((int)&unk_1001A758, "CoCreateInstance() IID_IMMDeviceEnumerator %X", *(_DWORD *)a5);
这一句和v6 = (int)operator new(0xCu);这句是什么意思呢?

int __stdcall sub_10002F20(int a1, int a2, int a3, const void *a4, char *a5)
{
int v5; // ebp@1
int v6; // eax@4
sub_10002520(&dword_1001A6C8);
v5 = dword_1001A6C8(a1, a2, a3, a4, a5);
sub_10002530(&dword_1001A6C8);
if ( !memcmp(a4, &unk_100131C0, 16) )
{
if ( a5 )
{
sub_100071B0((int)&unk_1001A758, "CoCreateInstance() IID_IMMDeviceEnumerator %X", *(_DWORD *)a5);
if ( *(_DWORD *)a5 )
{
v6 = (int)operator new(0xCu);
if ( v6 )
{
*(_DWORD *)a5 = sub_100091D0(v6, *(_DWORD *)a5);
return v5;
}
*(_DWORD *)a5 = 0;
}
}
}

下面是调用的两个函数代码。
int sub_100071B0(int a1, char *Format, ...)
{
int result; // eax@2
va_list va; // [sp+Ch] [bp+Ch]@1

va_start(va, Format);
if ( *(_DWORD *)(a1 + 556) >= 2u )
result = sub_100070D0((int)"INF", Format, va);
return result;
}

int __thiscall sub_100091D0(int this, int a2)
{
int v2; // esi@1
LONG v3; // eax@1

v2 = this;
*(_DWORD *)(this + 4) = &off_10013224;
v3 = InterlockedIncrement(&dword_1001A988);
sub_100071B0(&unk_1001A758, "CCounter()++ %d", v3);
*(_DWORD *)(v2 + 8) = a2;
*(_DWORD *)v2 = off_100133C8;
*(_DWORD *)(v2 + 4) = &off_100133C4;
sub_100071B0(&unk_1001A758, "IMMDeviceEnumerator_wr+++");
return v2;
}

Viewing all articles
Browse latest Browse all 9556

Latest Images

Trending Articles

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>