Question

MOV EDX,[EAX+4]

这句特征码怎么改

MOV EDX,[EAX+4]
004014A9 |. 8BF1 mov esi, ecx
004014AB |. 891424 mov [esp], edx
004014AE |. 8BE8 mov ebp, eax
004014B0 |. 8B5D 00 mov ebx, [ebp]
004014B3 |. 8B0424 mov eax, [esp]
004014B6 |. 8B10 mov edx, [eax]
004014B8 |. 8916 mov [esi], edx
004014BA 8B50 04 mov edx, [eax+4] 此处为特征码，如何修改？
004014BD 8956 04 mov [esi+4], edx
004014C0 > 8B3B mov edi, [ebx]
004014C2 ? 8B43 08 mov eax, [ebx+8]
004014C5 ? 8BD0 mov edx, eax

Answer 1

这句话的意思是将[EAX+4]里的内容移动到EDX寄存器中
用的是寄存器基址寻址