主要是作为个人笔记，自娱自乐，大手子们，不喜勿喷.

源自一个简单的想法，通过特征码匹配模式来识别反汇编除法。后续逐步收集switch-case和虚函数等特征码来完善现在的树结构。

---

下面是要匹配的三种模式:

1. "MethodModel":"argc/-4=%d"
2. "MethodModel":"uargc/7=%u"
3. "MethodModel":"argc/7=%d"

按照规则,构建的属性结构如下(此处显示部分,完整版附件下载DivTree.json)：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

{"div":{     "Left":{         "shr":{             "Left":{                 "add":{                     "Left":{                         "shr":{                             "Leaf":"End",                             "MethodModel":"uargc/7=%u"                         }                     },                     "Leaf":"End",                     "MethodModel":"argc/7=%d",                     "Right":null                 }             },             "Right":null         }},     "Right": {         "Left":{             "sar":{                 "Left":{                     "neg":{                         "Leaf":"End",                         "MethodModel":"argc/-4=%d"                     }                 }             }         }     },     "Reverse":{     } }}

通过解析，提取关键数据计算除数，代码如下:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

import re from ASTCore import *   HelloASTCore()   # argc/7=%d # 除数为有符号非2的幂 def div_argc_7_d():     print("argc/7=%d")     bigNum = int(lsInsUp[-1].split(",")[1].replace('h',''),16)     matchKeyPos = [i for i, s in enumerate(lsInsUp) if re.search(r'sar\s+edx',s)] # the pos of shr     if len(matchKeyPos)>0:         powerNum = 32 + int(lsInsUp[matchKeyPos[0]].split(",")[1].replace('h',''), 16)         print(f"div: /{2**powerNum/bigNum}")   # argc/-4=%d # 除数为有符号负2的幂 def div_argc_neg_4_d():     print("argc/-4=%d")     num = int(lsInsDown[0].split(",")[1], 16)     print("num=",num)     print(f"div: /-{num**2}")       AnalyCaseTable = {"argc/7=%d":div_argc_7_d, "argc/-4=%d":div_argc_neg_4_d} for k,v in AnalyCaseTable.items():     if k == methodMatched:         v()

测试一个分析的代码片段:

1 2 3 4 5 6 7

002210B9 mov         eax,92492493h 002210BE imul        esi 002210C0 add         edx,esi 002210C2 sar         edx,2 002210C5 mov         eax,edx 002210C7 shr         eax,1Fh 002210CA add         eax,edx

分析的结果如下:

---

如果有感兴趣的朋友，可以私信我，一起探讨相关话题.

上传的附件

ASTCore.py
data.asm
DisasmAnaly.py
DivTree.json