|
|
发表于 2005-2-8 20:52:29
|
显示全部楼层
呵呵,有意思
刚反汇编看了下,像6692975所说在halt程序里判断了运行程式名称是否是reboot或poweroff,然后halt设置适当的参数调用/sbin/shutdown程序关机或重起
可把软连接reboot改名后运行即关机了(非重启)
部分halt反汇编代码如下
- t:08048F6F loc_8048F6F: ; CODE XREF: sub_8048F00+2F5j
- .text:08048F6F mov ds:dword_804A1B4, eax
- .text:08048F74 mov edi, offset aReboot ; "reboot"
- .text:08048F79 mov ecx, 7
- .text:08048F7E cld
- .text:08048F7F mov ebx, ds:dword_804A1B4
- .text:08048F85 mov esi, ebx
- .text:08048F87 repe cmpsb
- .text:08048F89 jnz short loc_8048F92
- .text:08048F8B mov [ebp+var_10], 1[color=Red]////这里设置是reboot标志[/color]
- .text:08048F92
- .text:08048F92 loc_8048F92: ; CODE XREF: sub_8048F00+89j
- .text:08048F92 cld
- .text:08048F93 mov edi, offset aPoweroff ; "poweroff"
- .text:08048F98 mov ecx, 9
- .text:08048F9D mov esi, ebx
- .text:08048F9F repe cmpsb
- .text:08048FA1 jnz short loc_8048FB0
- .text:08048FA3
- .text:08048FA3 loc_8048FA3: ; CODE XREF: sub_8048F00+D8j
- .text:08048FA3 ; DATA XREF: .rodata:08049E58o
- .text:08048FA3 mov [ebp+var_2C], 1 ; case 0x70[color=Red]//这里设置poweroff标志[/color]
- .text:08048FAA lea esi, [esi+0]
- .text:08048FB0
- .text:08048FB0 loc_8048FB0: ; CODE XREF: sub_8048F00+A1j
- .text:08048FB0 ; sub_8048F00+EDj ...
- .text:08048FB0 mov edx, [ebp+arg_4]
- .text:08048FB3 mov edi, offset aIhdfnpwt ; ":ihdfnpwt:"
复制代码
下面
- .text:0804919B mov edx, [ebp+var_10] [color=Red]//判断上面的reboot标志[/color]
- .text:0804919E mov eax, [ebp+var_30]
- .text:080491A1 test edx, edx
- .text:080491A3 mov [esp+48h+var_44], eax
- .text:080491A7 mov eax, offset aR ; "-r"
- .text:080491AC jnz short loc_80491B3 [color=Red] //如果不为0,即是reboot[/color]
- .text:080491AE mov eax, offset asc_8049E3C ; "-h"[color=Red] //所以不加-h参数[/color]
- .text:080491B3
- .text:080491B3 loc_80491B3: ; CODE XREF: sub_8048F00+2ACj
- .text:080491B3 mov [esp+48h+var_48], eax
- .text:080491B6 call shutdown [color=Red]//这个call里面_execv调用shutdown程序[/color]
复制代码 |
|