问个memcmp的问题，想修改他最后的返回值，有点牵涉到汇编的，懂的进来看看。

2004-11-24 03:56:55 287 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

CVE-2012-2122漏洞复现：MySQL身份认证绕过原理与实战分析身份认证是数据库安全的核心防线，其原理通常基于密码或令牌的比对验证。在底层实现中，内存比较函数（如memcmp）的返回值处理至关重要，任何逻辑缺陷都可能导致认证机制被绕过。CVE-2012-2122正是这样一个经典案例，它源于MySQL在特定编译环境下对memcmp返回值的错误处理，使得错误的密码在一定概率下被误判为正确，从而实现了身份认证绕过。这类逻辑漏洞的价值在于揭示了安全编码的深层风险，即即使算法本身正确，底层实现细节和编译器优化也可能引入非预期的行为。其应用场景广泛，从数据库渗透测试到安全开发规范制阅读详情

请问memcmp这个函数他返回的效果和strcmp一样的，如果我想要memcmp来返回2个连续内存中首个不相同的地址，那么应该怎么去修改这个memcmp？？全是汇编啊，看不懂 @@
有会的请帮我看看怎么修改？？我个人觉得汇编可能比较快一点，所以想改这段汇编代码，请看清问题再回答。
附memcmp的汇编代码：
CODESEG

public memcmp
memcmp proc

.FPO ( 0, 3, 0, 0, 0, 0 )

mov eax,[esp+0ch] ; eax = counter
test eax,eax ; test if counter is zero
jz short retnull ; return 0

mov edx,[esp+4] ; edx = buf1
push esi
push edi
mov esi,edx ; esi = buf1
mov edi,[esp+10h] ; edi = buf2

; Check for dword (32 bit) alignment
or edx,edi
and edx,3 ; edx=0 iff buf1 are buf2 are aligned
jz short dwords

; Strings are not aligned. If the caller knows the strings (buf1 and buf2) are
; different, the function may be called with length like -1. The difference
; may be found in the last dword of aligned string, and because the other
; string is misaligned it may cause page fault. So, to be safe. the comparison
; must be done byte by byte.
test eax,1
jz short main_loop

mov cl,[esi]
cmp cl,[edi]
jne short not_equal
inc esi
inc edi
dec eax
jz short done ; eax is already 0

main_loop:
mov cl,[esi]
mov dl,[edi]
cmp cl,dl
jne short not_equal

mov cl,[esi+1]
mov dl,[edi+1]
cmp cl,dl
jne short not_equal

add edi,2
add esi,2

sub eax,2
jnz short main_loop
done:
pop edi
pop esi
retnull:
ret ; _cdecl return

dwords:
mov ecx,eax
and eax,3 ; eax= counter for tail loop

shr ecx,2
jz short tail_loop_start
; counter was >=4 so may check one dword
rep cmpsd

jz short tail_loop_start

; in last dword was difference
mov ecx,[esi-4] ; load last dword from buf1 to ecx
mov edx,[edi-4] ; load last dword from buf2 to edx
cmp cl,dl ; test first bytes
jne short difference_in_tail
cmp ch,dh ; test seconds bytes
jne short difference_in_tail
shr ecx,10h
shr edx,10h
cmp cl,dl ; test third bytes
jne short difference_in_tail
cmp ch,dh ; they are different, but each one is bigger?
; jmp short difference_in_tail

difference_in_tail:
mov eax,0
; buf1 < buf2 buf1 > buf2
not_equal:
sbb eax,eax ; AX=-1, CY=1 AX=0, CY=0
pop edi ; counter
sbb eax,-1 ; AX=-1 AX=1
pop esi
ret ; _cdecl return

; in tail loop we test last three bytes (esi and edi are aligned on dword
; boundary)
tail_loop_start:

test eax,eax ; eax is counter%4 (number of bytes for tail
; loop)
jz short done ; taken if there is no tail bytes
mov edx,[esi] ; load dword from buf1
mov ecx,[edi] ; load dword from buf2
cmp dl,cl ; test first bytes
jne short difference_in_tail
dec eax ; counter--
jz short tail_done
cmp dh,ch ; test second bytes
jne short difference_in_tail
dec eax ; counter--
jz short tail_done
and ecx,00ff0000h ; test third bytes
and edx,00ff0000h
cmp edx,ecx
jne short difference_in_tail
dec eax
tail_done:
pop edi
pop esi
ret ; _cdecl return

memcmp endp
end

...全文