case 0: exit case 1: pop eax;push 2;jmp (eax&0x3fffffff)+1 case 2: 进行函数调用,得到flag case 5: pop eax;jmp (eax&0x3fffffff)+1 case 6: pop eax;pop ebx;jmp (ebx&0x3fffffff)+1 case 7: push 0 case 8: push 1 case 0xD: push offset;offset = 4 || 2 || 1 byte case 0xE: push offset;offset = 4 || 2 || 1 byte no | 0x80000000 case 0xF: v10 = eax;pop eax case 0x10: push [esp] case 0x11: push(~[esp]) case 0x12: pop eax;pop ebx;push eax+ebx pc+=1 case 0x13: pop eax;pop ebx;push eax-ebx pc+=1 case 0x14: pop eax;pop ebx;push eax*ebx pc+=1 case 0x15: pop eax;pop ebx;push eax/ebx pc+=1 case 0x16: pop eax;pop ebx;push eax%ebx pc+=1 case 0x17: pop eax;pop ebx;push 3 pc+=1 case 0x18: pop eax;pop ebx;push eax&ebx pc+=1 case 0x19: pop eax;pop ebx;push eax|ebx pc+=1 case 0x1A: case 0x1B: case 0x1C: case 0x1D: case 0x1E: pop eax;pop ebx;push 3 pc+=1 case 0x1F: pop eax;pop ebx;push 3 pc+=1 default: next_instruction