USER32!GetClipboardData: 001b:76e02ba7 8bff mov edi,edi 001b:76e02ba9 55 push ebp 001b:76e02baa 8bec mov ebp,esp 001b:76e02bac 83ec2c sub esp,2Ch 001b:76e02baf 57 push edi 001b:76e02bb0 8d45d4 lea eax,[ebp-2Ch] ; __out GETCLIPBDATA ±¸Á¶Ã¼ º¯¼ö Æ÷ÀÎÅÍ pClipData 001b:76e02bb3 50 push eax 001b:76e02bb4 ff7508 push dword ptr [ebp+8] ; uFormat => CF_TEXT(1) 001b:76e02bb7 e8d7ffffff call USER32!NtUserGetClipboardData (76e02b93) ; ÇöÀç Ŭ¸³º¸µå »óÅ ¾ò¾î¿È.. 001b:76e02bbc 33ff xor edi,edi 001b:76e02bbe 8945f4 mov dword ptr [ebp-0Ch],eax ; NtUserGetClipboardData ¸®ÅÏ °ª => HANDLE hData 001b:76e02bc1 3bc7 cmp eax,edi ; hData°¡ NULLÀÎÁö È®ÀÎ 001b:76e02bc3 0f846b630100 je USER32!GetClipboardData+0x1e (76e18f34) 001b:76e02bc9 8b45d4 mov eax,dword ptr [ebp-2Ch] ; pClipData.uFmtRet 001b:76e02bcc 53 push ebx 001b:76e02bcd 56 push esi 001b:76e02bce 394508 cmp dword ptr [ebp+8],eax ; ¾ò¾î¿Â ÇöÀç Ŭ¸³º¸µå formatÀÌ CF_TEXT ¿Í ´Ù¸£¸é Á¡ÇÁ °°À¸¸é Á¡ÇÁ ¾ÈÇÔ 001b:76e02bd1 0f85cbf7ffff jne USER32!GetClipboardData+0x33 (76e023a2) ; ºÐ¼® ½ÃÁ¡ÀÌ ´Þ¶óÁ®¼­ ÁÖ¼Ò°¡ ´Þ¶óÁü;; Á¡ÇÁ ¾ÈÇÑ °æ¿ì - ÇöÀç Ŭ¸³º¸µå¿¡ ÀÖ´Â µ¥ÀÌÅÍ°¡ CF_TEXT ÀÎ °æ¿ì 001b:76972bd7 6820929b76 push offset user32!gcsClipboard (769b9220) 001b:76972bdc ff1524119576 call dword ptr [user32!_imp__RtlEnterCriticalSection (76951124)] ; gcsClipboard Àü¿ªº¯¼ö¸¦ Å©¸®Æ¼Äü½¼Ç¿¡ ¹­À½ 001b:76972be2 a1fc999b76 mov eax,dword ptr [user32!gphn (769b99fc)] ; gphn => Ŭ¸³º¸µå ±¸Á¶Ã¼, ÀÌ ±¸Á¶Ã¼°¡ üÀÌ´× ÇüÅ·ΠÀÖÀ½. 001b:76972be7 8b5d08 mov ebx,dword ptr [ebp+8] 001b:76972bea 3bc7 cmp eax,edi ; gphn Àü¿ªº¯¼ö°¡ 0ÀÎÁö È®ÀÎ 001b:76972bec 7410 je user32!GetClipboardData+0x2d5 (76972bfe) ; 0ÀÌ¶ó¼­ Á¡ÇÁ; ÃßÃø : 0ÀÌ ¾Æ´Ï¶ó¸é Ŭ¸³º¸µå ±¸Á¶Ã¼ üÀ̴׿¡¼­ ÇöÀç ¿äû Á¤º¸¸¦ ¾ò¾î¿Ã °ÍÀÓ 001b:76972bfe 6a14 push 14h ; Size 001b:76972c00 6a08 push 8 ; Flags ( HEAP_ZERO_MEMORY ) 001b:76972c02 ff3590909b76 push dword ptr [user32!pUserHeap (769b9090)] ; HeapHandle 001b:76972c08 ff1530119576 call dword ptr [user32!_imp__RtlAllocateHeap (76951130)] 001b:76972c0e 8bf0 mov esi,eax ; hHeap1 => gphn º¯¼ö ÀÚ·áÇü°ú °°À½ => Newgphn 001b:76972c10 3bf7 cmp esi,edi 001b:76972c12 747a je user32!GetClipboardData+0x3b9 (76972c8e) ; ¼º°øÇß´ÂÁö È®ÀÎ 001b:76972c14 8b45f4 mov eax,dword ptr [ebp-0Ch] ; hData 001b:76972c17 894608 mov dword ptr [esi+8],eax 001b:76972c1a 8b4dd4 mov ecx,dword ptr [ebp-2Ch] ; pClipData.uFmtRet(1) 001b:76972c1d 894e04 mov dword ptr [esi+4],ecx 001b:76972c20 8b4dd8 mov ecx,dword ptr [ebp-28h] ; pClipData.fGlobalHandle 001b:76972c23 894e10 mov dword ptr [esi+10h],ecx 001b:76972c26 83fb0e cmp ebx,0Eh ; ebx = CF_TEXT(1) 001b:76972c29 0f873b640100 ja user32!GetClipboardData+0x358 (7698906a) 001b:76972c2f 0f848bfeffff je user32!GetClipboardData+0x382 (76972ac0) 001b:76972c35 83fb01 cmp ebx,1 001b:76972c38 742a je user32!GetClipboardData+0x398 (76972c64) ; Á¡ÇÁ 001b:76972c64 ff75f4 push dword ptr [ebp-0Ch] ; hData 001b:76972c67 e812010000 call user32!CreateLocalMemHandle (76972d7e) ; ¸®ÅÏ °ª Æ÷ÀÎÅÍ¿¡ Ŭ¸³º¸µå ¹®ÀÚ¿­ ÀÖÀ½ = hMem1 001b:76972c6c c7461001000000 mov dword ptr [esi+10h],1 ; hHeap1 ¿µ¿ª¿¡ 001b:76972c73 89460c mov dword ptr [esi+0Ch],eax 001b:76972c76 3bc7 cmp eax,edi 001b:76972c78 0f84d9630100 je user32!GetClipboardData+0x343 (76989057) 001b:76972c7e a1fc999b76 mov eax,dword ptr [user32!gphn (769b99fc)] 001b:76972c83 8906 mov dword ptr [esi],eax 001b:76972c85 8935fc999b76 mov dword ptr [user32!gphn (769b99fc)],esi ; Newgphn ¿Ï¼º ÇüÅ ; [Newgphn+0x00] = [gphn] Next gphn ÀÏ °ÍÀÓ ; [Newgphn+0x04] = pClipData.uFmtRet ; [Newgphn+0x08] = hData ; [Newgphn+0x0C] = hMem1 ; [Newgphn+0x10] = 1 001b:76972c8b 8b7e0c mov edi,dword ptr [esi+0Ch] 001b:76972c8e 6820929b76 push offset user32!gcsClipboard (769b9220) 001b:76972c93 ff1520119576 call dword ptr [user32!_imp__RtlLeaveCriticalSection (76951120)] 001b:76972c99 8bc7 mov eax,edi ; hMem1 ÀÌ ¸®ÅÏ °ª 001b:76972c9b 5e pop esi 001b:76972c9c 5b pop ebx 001b:76972c9d 5f pop edi 001b:76972c9e c9 leave 001b:76972c9f c20400 ret 4 Á¡ÇÁÇÑ °æ¿ì - ÇöÀç Ŭ¸³º¸µå¿¡ ÀÖ´Â µ¥ÀÌÅÍ°¡ CF_TEXT °¡ ¾Æ´Ñ °æ¿ì 001b:76e023a2 897df8 mov dword ptr [ebp-8],edi ; 0À¸·Î ÃʱâÈ­ 001b:76e023a5 897dfc mov dword ptr [ebp-4],edi ; 0À¸·Î ÃʱâÈ­ 001b:76e023a8 897de8 mov dword ptr [ebp-18h],edi ; 0À¸·Î ÃʱâÈ­ 001b:76e023ab 83f801 cmp eax,1 001b:76e023ae 740e je USER32!GetClipboardData+0x59 (76e023be) 001b:76e023b0 83f807 cmp eax,7 001b:76e023b3 7409 je USER32!GetClipboardData+0x59 (76e023be) 001b:76e023b5 83f80d cmp eax,0Dh 001b:76e023b8 0f857d6b0100 jne USER32!GetClipboardData+0x4b (76e18f3b) 001b:76e023be ff75f4 push dword ptr [ebp-0Ch] ; hData 001b:76e023c1 e8b8090000 call USER32!CreateLocalMemHandle (76e02d7e) ; ÀÎÀÚ 1°³ 001b:76e023c6 8945f8 mov dword ptr [ebp-8],eax ; ¸®ÅÏ °ª -> HGLOBAL hMem1 001b:76e023c9 3bc7 cmp eax,edi ; hMem1ÀÌ NULLÀÎÁö üũ 001b:76e023cb 0f84da060000 je USER32!GetClipboardData+0x2a2 (76e02aab) 001b:76e023d1 50 push eax ; hMem1 001b:76e023d2 ff15c814de76 call dword ptr [USER32!_imp__GlobalSize (76de14c8)] ; ÀÎÀÚ 1°³, ÀÎÀÚ·Î ÁöÁ¤µÈ Àü¿ª ¸Þ¸ð¸® ¿ÀºêÁ§Æ®ÀÇ ÇöÀç ¹ÙÀÌÆ® Å©±â±¸ÇÔ 001b:76e023d8 8bd8 mov ebx,eax ; GlobalSize ÇÔ¼ö ¸®ÅÏ °ª SIZE_T => 0x16 ( ¹Ù²ñ.. ) 001b:76e023da 895dec mov dword ptr [ebp-14h],ebx 001b:76e023dd 3bdf cmp ebx,edi ; ¸®ÅÏµÈ »çÀÌÁî°¡ 0ÀÎÁö È®ÀÎ 001b:76e023df 0f84bd060000 je USER32!GetClipboardData+0x244 (76e02aa2) 001b:76e023e5 8b4dd4 mov ecx,dword ptr [ebp-2Ch] ; pClipData.uFmtRet => 0x0d (CF_UNICODETEXT) 001b:76e023e8 83f901 cmp ecx,1 001b:76e023eb 740e je USER32!GetClipboardData+0x96 (76e023fb) 001b:76e023ed 83f907 cmp ecx,7 001b:76e023f0 7409 je USER32!GetClipboardData+0x96 (76e023fb) 001b:76e023f2 83f90d cmp ecx,0Dh 001b:76e023f5 0f8596060000 jne USER32!GetClipboardData+0x14f (76e02a91) 001b:76e023fb ff75dc push dword ptr [ebp-24h] ; pClipData.hLocale 001b:76e023fe e87b090000 call USER32!CreateLocalMemHandle (76e02d7e) 001b:76e02403 3bc7 cmp eax,edi ; hMem2 ¸®ÅÏ °ªÀÌ NULLÀÎÁö È®ÀÎ 001b:76e02405 0f847f060000 je USER32!GetClipboardData+0xad (76e02a8a) 001b:76e0240b 8b30 mov esi,dword ptr [eax] ; hMem2°¡ °¡¸®Å°´Â °ø°£ÀÇ Ã¹ 4Byte °¡Á®¿È => 0x0412 001b:76e0240d 50 push eax 001b:76e0240e ff15f814de76 call dword ptr [USER32!_imp__GlobalFree (76de14f8)] ; hMem2 ÇØÁ¦ 001b:76e02414 53 push ebx ; GlobalSize ÇÔ¼öÀÇ ¸®ÅÏ °ª 001b:76e02415 6a40 push 40h ; GMEM_ZEROINIT 001b:76e02417 ff151815de76 call dword ptr [USER32!_imp__GlobalAlloc (76de1518)] ; hMem1 ¿¡´ëÇØ GlobalSize ÇÑ Å©±â ¸¸Å­ Èü¿µ¿ª ÇÒ´ç 001b:76e0241d 8945fc mov dword ptr [ebp-4],eax ; HGLOBAL hAlloc 001b:76e02420 3bc7 cmp eax,edi ; Á¦´ë·Î °ø°£ÇÒ´ç ‰ç´ÂÁö È®ÀÎ 001b:76e02422 0f847a060000 je USER32!GetClipboardData+0x244 (76e02aa2) 001b:76e02428 8b4dd4 mov ecx,dword ptr [ebp-2Ch] ; pClipData.uFmtRet => 0x0d (CF_UNICODETEXT) 001b:76e0242b 8b4508 mov eax,dword ptr [ebp+8] ; CF_TEXT 001b:76e0242e 48 dec eax 001b:76e0242f 0f85146b0100 jne USER32!GetClipboardData+0xd0 (76e18f49) 001b:76e02435 c745e801000000 mov dword ptr [ebp-18h],1 001b:76e0243c 83f907 cmp ecx,7 001b:76e0243f 0f84ed6b0100 je USER32!GetClipboardData+0x1c7 (76e19032) 001b:76e02445 6804100000 push 1004h 001b:76e0244a 56 push esi ; 0x0412 001b:76e0244b e8ce000000 call USER32!GetClipboardCodePage (76e0251e) ; 0x03B5 ¸®ÅÏ.. 001b:76e02450 8b350415de76 mov esi,dword ptr [USER32!_imp__WideCharToMultiByte (76de1504)] 001b:76e02456 57 push edi 001b:76e02457 57 push edi 001b:76e02458 57 push edi 001b:76e02459 57 push edi 001b:76e0245a d1eb shr ebx,1 ; 0x16 -> 0xb µÊ 001b:76e0245c 53 push ebx 001b:76e0245d ff75f8 push dword ptr [ebp-8] ; hMem1 001b:76e02460 8945f0 mov dword ptr [ebp-10h],eax ; 0x03B5 001b:76e02463 57 push edi 001b:76e02464 50 push eax ; 0x03B5 001b:76e02465 ffd6 call esi ; WideCharToMultiByte 001b:76e02467 8945ec mov dword ptr [ebp-14h],eax ; ¸®ÅÏ °ª : ¼¼¹ø° ÀÎÀÚ 0x9 001b:76e0246a 3bc7 cmp eax,edi ; 0ÀÎÀÚ È®ÀÎ 001b:76e0246c 0f8427060000 je USER32!GetClipboardData+0x23b (76e02a99) 001b:76e02472 6a42 push 42h ; GMEM_MOVEABLE | GMEM_ZEROINIT 001b:76e02474 50 push eax ; 0x0b 001b:76e02475 ff75fc push dword ptr [ebp-4] ; hAlloc 001b:76e02478 ff151015de76 call dword ptr [USER32!_imp__GlobalReAlloc (76de1510)] ; ÀÎÀÚ 3°³ -> ¸®ÅÏ : HGLOBAL hMem3 001b:76e0247e 3bc7 cmp eax,edi ; ½ÇÆÐ Çß´ÂÁö üũ 001b:76e02480 0f8413060000 je USER32!GetClipboardData+0x23b (76e02a99) 001b:76e02486 57 push edi ; 0 001b:76e02487 57 push edi ; 0 001b:76e02488 ff75ec push dword ptr [ebp-14h] ; 0x9 ( __in cbMultiByte : lpMultiByteStr ¹öÆÛÀÇ ¹ÙÀÌÆ® Å©±â ) 001b:76e0248b 8945fc mov dword ptr [ebp-4],eax 001b:76e0248e 50 push eax ; hMem3 ( __out lpMultiByteStr : º¯È¯µÈ ¹®ÀÚ¿­À» ¹ÞÀ» ¹öÆÛ ) 001b:76e0248f 53 push ebx ; 0xb ( __in cchWideChar : lpWideCharStr ÀÇ ¹®ÀÚ¿­ °³¼ö ) 001b:76e02490 ff75f8 push dword ptr [ebp-8] ; hMem1 ( __in lpWideCharStr : º¯È¯ÇÒ À¯´ÏÄÚµå ¹®ÀÚ¿­ ) 001b:76e02493 57 push edi ; 0 ( dwFlags : º¯È¯ ŸÀÔ ) 001b:76e02494 ff75f0 push dword ptr [ebp-10h] ; 0x03B5 ( CodePage : º¯È¯Çϴµ¥ »ç¿ëµÇ´Â ÄÚµå ÆäÀÌÁö ) 001b:76e02497 ffd6 call esi ; ¸®ÅÏ : lpMultiByteStr ¿¡ ¼º°øÀûÀ¸·Î ¾²¿©Áø ¹ÙÀÌÆ® °³¼ö 001b:76e02499 85c0 test eax,eax 001b:76e0249b 0f84f8050000 je USER32!GetClipboardData+0x23b (76e02a99) 001b:76e024a1 397dfc cmp dword ptr [ebp-4],edi ; hMem3ÀÌ NULLÀÎÁö üũ 001b:76e024a4 7416 je USER32!GetClipboardData+0x24f (76e024bc) 001b:76e024a6 ff75e8 push dword ptr [ebp-18h] ; 1 ( cbData ) 001b:76e024a9 ff75fc push dword ptr [ebp-4] ; hMem3 ( ccxlpData ) 001b:76e024ac e8e4030000 call USER32!ConvertMemHandle (76e02895) ; µ¥ÀÌÅ͸¦ Ŭ¸³º¸µå ¸Þ¸ð¸® ÇÚµé·Î ¹Ù²Þ.( ÀÌ ÇÚµéÀº ù¹ø° DWORDÀÇ Å©±â¸¦ Æ÷ÇÔ ) 001b:76e024b1 8945f4 mov dword ptr [ebp-0Ch],eax ; HANDLE hMem4 001b:76e024b4 3bc7 cmp eax,edi 001b:76e024b6 0f84dd050000 je USER32!GetClipboardData+0x23b (76e02a99) 001b:76e024bc be2092e476 mov esi,offset USER32!gcsClipboard (76e49220) 001b:769724c1 56 push esi ; gcsClipboard 001b:769724c2 ff1524119576 call dword ptr [user32!_imp__RtlEnterCriticalSection (76951124)] ; gcsClipboard°¡ Àü¿ªº¯¼ö À̹ǷΠũ¸®Æ¼Äü½¼ÇÀÌ¿ë 001b:769724c8 8b45d8 mov eax,dword ptr [ebp-28h] ; pClipData.fGlobalHandle 001b:769724cb 8945e0 mov dword ptr [ebp-20h],eax 001b:769724ce 8d45e0 lea eax,[ebp-20h] 001b:769724d1 50 push eax ; &pClipData.fGlobalHandle 001b:769724d2 ff75f4 push dword ptr [ebp-0Ch] ; hMem4 001b:769724d5 897de4 mov dword ptr [ebp-1Ch],edi 001b:769724d8 ff7508 push dword ptr [ebp+8] ; CF_TEXT 001b:769724db e8a1030000 call user32!NtUserSetClipboardData (76972881) ; ¼º°ø ½Ã hMem4°¡ ±×´ë·Î ¸®ÅÏ 001b:769724e0 85c0 test eax,eax 001b:769724e2 0f845a6b0100 je user32!GetClipboardData+0x277 (76989042) ; 001b:769724e8 56 push esi ; gcsClipboard 001b:769724e9 ff1520119576 call dword ptr [user32!_imp__RtlLeaveCriticalSection (76951120)] 001b:769724ef 397dfc cmp dword ptr [ebp-4],edi 001b:769724f2 7409 je user32!GetClipboardData+0x28f (769724fd) 001b:769724f4 ff75fc push dword ptr [ebp-4] ; hMem3 001b:769724f7 ff15f8149576 call dword ptr [user32!_imp__GlobalFree (769514f8)] 001b:769724fd 397df8 cmp dword ptr [ebp-8],edi 001b:76972500 7409 je user32!GetClipboardData+0x29d (7697250b) 001b:76972502 ff75f8 push dword ptr [ebp-8] ; hMem1 001b:76972505 ff15f8149576 call dword ptr [user32!_imp__GlobalFree (769514f8)] 001b:7697250b 397df4 cmp dword ptr [ebp-0Ch],edi ; hMem4 001b:7697250e 0f85c3060000 jne user32!GetClipboardData+0x2a9 (76972bd7) ; Á¡ÇÁ ¾ÈÇÑ °æ¿ì - ÇöÀç Ŭ¸³º¸µå¿¡ ÀÖ´Â µ¥ÀÌÅÍ°¡ CF_TEXT ÀÎ °æ¿ì ·Î Á¡ÇÁ