iopl

ModLoad: 77670000 776b4000 C: \Windows\syswow64\KERNELBASE. dll eax = 00000000 ebx = 00000000 ecx = f2260000 edx = 0016ddd8 esi = fffffffe edi = 77da3bdc eip = 77e207ff esp = 002df598 ebp = 002df5c4 iopl = 0 nv up ei pl zr na pe nc

博客园-首页原创精华区 donjuan 2010

Debug Fundamentals Exercise 4: GAMEOVER eax = 53454750 ebx = 00000000 ecx = 00000100 edx = 000001b0 esi = 001bfe20 edi = 00ac36bc eip = 47414d45 esp = 001bfe00 ebp = 4f564552 iopl = 0 nv up ei pl zr na pe nc The attached zip, dbgex4. zip, includes three files.

MSDN Blogs 2009

WINMM! timeSetTimerEvent+0x5a (76b0ac34) 76b0ac30 3bc7 jbe WINMM! timeSetTimerEvent+0x62 (76b0ac3c) 0: 000 > p eax = e3c3fcac ebx = 76b10200 ecx = 00000000 edx = e3c3f21c esi = eip = 76b0ac02 esp = 0012fdf4 ebp = 0012fe04 iopl = 0

MSDN Blogs 2009

Looks like the dll is not getting loaded; nothing shows up in the module list. eax = 13372065 ebx = 00000000 ecx = 04361fb8 edx = 7e9086ed esi = 04361fb8 edi = 054200a8 eip = 7ea81ddc esp = 01fbfca0 ebp = 01fbfcc0 iopl = 0 nv up ei pl nz na pe nc cs = 001b ss = 0023 ds = 0023 es = 0023 fs = 003b gs = 0000 efl = 00010206

Metasploit Exploit Updates 2009

The bracket notation [] in the assembly means to treat the value in brackets as a memory address, and access the value at that address. eax = 00000007 ebx = 7ffd9000 ecx = ffffffff edx = 00000007 esi = 00001771 edi = 00000000 eip = 0040101c esp = 0012fe9c ebp = 0012feac iopl = 0 nv up ei pl nz na po nc

MSDN Blogs 2008

The bracket notation [] in the assembly means to treat the value in brackets as a memory address, and access the value at that address. eax = 00000007 ebx = 7ffd9000 ecx = ffffffff edx = 00000007 esi = 00001771 edi = 00000000 eip = 0040101c esp = 0012fe9c ebp = 0012feac iopl = 0 nv up ei pl nz na po nc

MSDN Blogs 2008

NET\Framework\v2. 0.50727\mscorjit.dll eax = 00000000 ebx = 00000000 ecx = 00d90000 edx = 7c90eb94 esi = 00000000 edi = 00000000 eip = 7c90eb94 esp = 0012e554 ebp = 0012e648 iopl = 0 nv up ei ng nz ac pe nc

博客园首页 2008

The bracket notation [] in the assembly means to treat the value in brackets as a memory address, and access the value at that address. eax = 00000007 ebx = 7ffd9000 ecx = ffffffff edx = 00000007 esi = 00001771 edi = 00000000 eip = 0040101c esp = 0012fe9c ebp = 0012feac iopl = 0 nv up ei pl nz na po nc

MSDN Blogs 2008

Last set context: eax = 80800000 ebx = 028c4000 ecx = a2b3d020 edx = 000d9000 esi = a2b3cf68 edi = a35c1004 eip = b8c4952e esp = b76c59cc ebp = b76c5a08 iopl = 0 nv up ei pl nz na po nc cs = 0008 ss = 0010 ds = 0023 es = 0023 fs = 0030 gs = 0000 efl = 00010202 0008

MSDN Blogs 2008

Last set context: eax = 80800000 ebx = 028c4000 ecx = a2b3d020 edx = 000d9000 esi = a2b3cf68 edi = a35c1004 eip = b8c4952e esp = b76c59cc ebp = b76c5a08 iopl = 0 nv up ei pl nz na po nc cs = 0008 ss = 0010 ds = 0023 es = 0023 fs = 0030 gs = 0000 efl = 00010202 0008

MSDN Blogs 2008