分析一段常用代码

相关网站：http://edu.teamsourcing.com.cn

下面的几句代码，不论eax初始值 是多少，最后的结果是eax 的值为1。

   sbb eax,eax 
   sbb eax,0ffffffffh
   test eax,eax

这个在循环中比较有用，例如下面的一个函数中这段代码的用法。

FindWinExecStringInFile proc uses ebx esi edi

local @Buffer[1000h]:byte
local @NumberOfBytesRead:dword
local @hFile:dword

comment^
    只读方式打开ecx 参数传入的文件,如果打开失败，则返回0 ，退出
comment^
                push    0
                push    80h
                push    3
                push    0
                push    7
                push    80000000h
                push    ecx
                call    CreateFileA
                
                mov     @hFile, eax
                cmp     @hFile, 0FFFFFFFFh
                jz      short OpenFailed
                
comment^
     设置文件指针指向开始位置
comment^
                push    0
                push    0
                push    0
                push    @hFile
                call    SetFilePointer
                
comment^
     从文件中读取1000h字节内容到缓冲区中,读取失败，跳转，关闭文件，返回0，退出
comment^                
                lea     eax, @NumberOfBytesRead
                lea     ecx, @Buffer
                push    0
                push    eax
                push    1000h
                push    ecx
                push    @hFile
                call    ReadFile
                test    eax, eax
                jz      short ReadFailed
                
                xor     edi, edi

SerchTheFirstChar:        
comment^
     判断当前缓冲区中取出的字符是否是57h, 即 'W',如果不是则继续循环找.缓冲区大小共1000h，
     查找返回是edi从0到ff9h，因为"WinExec"自身长度是7。 
comment^                
                     
                mov     cl, [edi+@Buffer]
                lea     eax, [edi+@Buffer]
                cmp     cl, 57h               
                jnz     short GoOnSearch
                mov     esi, offset aWinexec
                
comment^
     找到开始的'W'字符后，开始比较两个字符串。 如果后续某个字符不相等，则继续寻找开始的'W'字符。
     如果后续buffer中取出的字符是结束符'\0'则结束循环，关闭文件，返回1，退出。
comment^       
CMPNEXTCHAR:                          
                mov     dl, [eax]
                mov     bl, [esi]
                mov     cl, dl
                cmp     dl, bl
                jnz     short NotEqual
                test    cl, cl
                jz      short CharEOF
                mov     dl, [eax+1]
                mov     bl, [esi+1]
                mov     cl, dl
                cmp     dl, bl
                jnz     short NotEqual
                add     eax, 2
                add     esi, 2
                test    cl, cl
                jnz     short CMPNEXTCHAR

CharEOF:                            
                xor     eax, eax
                jmp     short IsSerachOver
; ---------------------------------------------------------------------------

NotEqual:                            
               sbb     eax, eax
                sbb     eax, 0FFFFFFFFh

IsSerachOver:                            
                test    eax, eax
                jz      short SearchOver

GoOnSearch:                            
                inc     edi
                cmp     edi, 0FF9h
                jb      short SerchTheFirstChar

ReadFailed:                            
                push    @hFile
                call    CloseHandle

OpenFailed:                             
              
                xor     eax, eax
                ret
; ---------------------------------------------------------------------------

SearchOver:                            
                push    @hFile
                call    CloseHandle
                mov     eax, 1                         
                ret
FindWinExecStringInFile endp

相关网站：http://edu.teamsourcing.com.cn