逆向常见指令笔记

test eax, eax

用来判断eax是否为0, 为0则跳转

和 cmp eax, 0 在比较时几乎一样

if (eax == 0) {
    // do something
}

eax = eax == 0 ? 1 : 0

neg eax                  ; cf = if eax != 0 { 1 } else { 0 }
sbb eax, eax             ; eax = -cf
inc eax                  ; eax = -cf + 1

总结:

eax = eax == 0 ? 1 : 0

cf = eax == 0 ? 1

lea eax, [rsp + 0x20]

相当于 eax = rsp + 0x20 如果是mov的话, 是 eax = [rsp + 0x20]