我有一個建立連接的 .cpp 檔案，與 g 完美組裝。我還有一個 32 位 exe 也可以建立連接。現在的問題是我想使用 64 位匯編來建立這個連接。我能夠使用所有正確的引數（2,1,6,0,0,0）呼叫 WSASocketA，但我根本無法回傳套接字描述符。我得到-1（0xFFFFFFFF）。然后我注意到我可以呼叫 WSAGetLastError 并回傳 10022。但我的論點是正確的。我按順序分析了來自我的 cpp 連接器的 objdump，它具有相同的確切引數。而且我完全知道在 Windows 中使用正確的 64 位呼叫約定。
我正在使用 nasm 并為我的聯結器嘗試了鏈接和 GoLinker.exe，它們產生了相同的確切輸出。我在鏈接時明確使用 C:\Program Files (x86)\Windows Kits\10\Lib\10.0.19041.0\um\x64 中的 ws2_32.lib 以及 kernel32.lib 和 ucrt.lib 以及 64 位. 是否有某種原因我無法獲得套接字描述符。我很確定我的代碼是正確的：
BITS 64
SECTION .data
fmtd:
db "%d", 0x0a,0
fmts:
db "%s", 0x0a,0
SECTION .bss
;pStru: resq 1 ; This is a pointer for a dynamically created structure - malloc style
pStru: resb 0x190 ; Shadow space for a statically created structure
SECTION .text
extern printf
extern malloc
global main
main:
;push rbp
;mov rbp, rsp
;sub rsp, 0x28 ; 40 bytes of shadow space
;and rsp, 0FFFFFFFFFFFFFFF0h ; Align the stack to a multiple of 16 bytes
; Parse PEB and find kernel32
xor rcx, rcx ; RCX = 0
mov rax, [gs:rcx 0x60] ; RAX = PEB
mov rax, [rax 0x18] ; RAX = PEB->Ldr
mov rsi, [rax 0x20] ; RSI = PEB->Ldr.InMemOrder
lodsq ; RAX = Second module
xchg rax, rsi ; RAX = RSI, RSI = RAX
lodsq ; RAX = Third(kernel32)
mov rbx, [rax 0x20] ; RBX = Base address
; Parse kernel32 PE
xor r8, r8 ; Clear r8
mov r8d, [rbx 0x3c] ; R8D = DOS->e_lfanew offset
mov rdx, r8 ; RDX = DOS->e_lfanew
add rdx, rbx ; RDX = PE Header
mov r8d, [rdx 0x88] ; R8D = Offset export table
add r8, rbx ; R8 = Export table
xor rsi, rsi ; Clear RSI
mov esi, [r8 0x20] ; RSI = Offset namestable
add rsi, rbx ; RSI = Names table
xor rcx, rcx ; RCX = 0
mov r9, 0x41636f7250746547 ; GetProcA
; Loop through exported functions and find GetProcAddress
Get_Function:
inc rcx ; Increment the ordinal
xor rax, rax ; RAX = 0
mov eax, [rsi rcx * 4] ; Get name offset
add rax, rbx ; Get function name
cmp QWORD [rax], r9 ; GetProcA ?
jnz Get_Function
xor rsi, rsi ; RSI = 0
mov esi, [r8 0x24] ; ESI = Offset ordinals
add rsi, rbx ; RSI = Ordinals table
mov cx, [rsi rcx * 2] ; Number of function
xor rsi, rsi ; RSI = 0
mov esi, [r8 0x1c] ; Offset address table
add rsi, rbx ; ESI = Address table
xor rdx, rdx ; RDX = 0
mov edx, [rsi rcx * 4] ; EDX = Pointer(offset)
add rdx, rbx ; RDX = GetProcAddress
mov rdi, rdx ; Save GetProcAddress in RDI
; Use GetProcAddress to find the address of LoadLibrary
mov rcx, 0x41797261 ; aryA
push rcx ; Push on the stack
mov rcx, 0x7262694c64616f4c ; LoadLibr
push rcx ; Push on stack
mov rdx, rsp ; LoadLibraryA
mov rcx, rbx ; kernel32.dll base address (rbx never changes so we could use it later for CreateProcessA)
sub rsp, 0x20 ; Allocate stack space for function call
call rdi ; Call GetProcAddress
add rsp, 0x20 ; Cleanup allocated stack space
mov rsi, rax ; LoadLibrary saved in RSI
;getws2_32:
mov rcx, 0x6c6c ; ll
push rcx ; Push on the stack
mov rcx, 0x642e32335f327377 ; d.32_2sw
push rcx ; Push on the stack
mov rcx, rsp ; ws2_32.dll
sub rsp, 0x20 ; Allocate stack space for function call
call rsi ; call Loadlibrary (stored in rsi) and find ws2_32.dll
add rsp, 0x20 ; Cleanup allocated stack space
mov r15, rax ; base address of ws2_32.dll saved in local variable r15 (winsock handle)
;getWSAStartup:
mov rcx, 0x7075 ; pu
push rcx ; Push on the stack
mov rcx, 0x7472617453415357 ; tratSASW
push rcx ;Push on the stack
mov rdx, rsp ; copy WSAStartup from stack to 2nd argument (rdx is the 2nd arg)
mov rcx, r15 ; winsock handler
sub rsp, 0x20 ; Allocate stack space for function call
call rdi ; GetProcAddress(ws2_32.dll, WSAStartup)
add rsp, 0x20 ; Cleanup allocated stack space
mov r14, rax ; ws2_32.WSAStartup saved in r14
;callWSAStartUp:
; malloc style just uncomment resq 0x190 for pStru in .bss
;mov rcx, 0x198 ; size of the structure
;call malloc ; get the memory allocated
;mov qword [ pStru ], rax ; store the address in the pointer
;xor rdx, rdx
;lea rdx, [ pStru ] ; pointer to our WSAData structure
;xor rcx, rcx
;mov cx, 0x202
;call r14
; stack style
;xor rcx, rcx
;mov cx, 0x190 ; 0x190 works only when 0x28 bytes are subtracted, no more, no less!!!
;sub rsp,rcx
;lea rdx,[rsp]
;xor rcx, rcx
;mov cx,0x202
;sub rsp, 0x28
;call r14 ; call WSAStartup(MAKEWORD(2, 2), wsadata_pointer)
;add rsp, 0x28
;add rsp, 0x190
; static (.bss) style just uncomment resb 0x190 for pStru in .bss
xor rdx, rdx
lea rdx, [ pStru ] ; pointer to our WSAData structure
xor rcx, rcx
mov cx, 0x202 ; version 2,2 = 514 in decimal = 0x202 in hex, must be a word (2 bytes so only register cx is used)
sub rsp, 0x28
call r14
add rsp, 0x28
; print return value from WSAStartup (0 if no errors)
mov rdx, rax
mov rcx, fmtd
sub rsp, 0x20
call printf
add rsp, 0x20
;getWSASocketA:
xor rdx, rdx
xor rcx, rcx
mov rcx, 0x4174 ; 'At' original
push rcx ; push on stack
mov rcx, 0x656b636f53415357 ; 'ekcoSASW'
push rcx ; push on stack
mov rdx, rsp ; copy string of WSASocketA contents from stack to rdx (2nd arg for GetProcAddress)
mov rcx, r15 ; socket handler ws2_32.dll
sub rsp, 0x30
call rdi ; GetProcAddress(ws2_32.dll, WSASocketA)
add rsp, 0x30 ; Cleanup allocated stack space: standard is 32 bytes but 2 pushes = 16 more = 48 = 0x30
mov r13, rax ; save ws2_32.WSASocketA to r13
;callWSASocketA:
xor r9, r9 ; lpProtocolInfo=NULL (uses itself from above: NULL)
push r9 ; dwFlags=NULL
push r9 ; g=NULL
xor r8, r8
mov r8, 0x6 ; protocol=6
xor rdx, rdx
mov rdx, 0x1 ; type=1
xor rcx, rcx
mov rcx, 0x2 ; af=2
sub rsp, 0x28
call r13 ; call WSASocketA
add rsp, 0x28 ; Cleanup allocated stack space = 48 bytes = 0x30
mov r14, rax ; save socket descriptor of WSASocketA to r14
; print return value from WSASocketA (should be a socket descriptor)
xor rdx, rdx
mov rdx, r14
mov rcx, fmtd
sub rsp, 0x20
call printf
add rsp, 0x20
;getWSAGetLastError:
xor rcx, rcx
mov rcx, 0x726f7272457473 ; rorrEts
push rcx
mov rcx, 0x614c746547415357 ; aLteGSASW
push rcx ;Push on the stack
mov rdx, rsp ; copy WSAGetLastError from stack to 2nd argument (rdx is the 2nd arg)
mov rcx, r15 ; winsock handler
sub rsp, 0x30 ; Allocate stack space for function call
call rdi ; GetProcAddress(ws2_32.dll, WSAStartup)
add rsp, 0x30 ; Cleanup allocated stack space
mov r11, rax ; ws2_32.WSAGetLastError saved in r11
;callWSAGetLastError:
call r11
; print return value from WSAGetLastError (which should be an error number if WSASocketA failed)
xor rdx, rdx
mov rdx, rax
mov rcx, fmtd
sub rsp, 0x20
call printf
add rsp, 0x20
完成后，rax 的值為 -1 而不是我的 cpp 連接器的 264 或 256。有任何想法嗎？在過去的幾天里，我一整天都在不停地除錯這個。我的程式沒有崩潰，它根本沒有得到套接字描述符。謝謝。
使用 GoLink.exe：
nasm -f win64 connect64.s
c:\Golink\GoLink.exe /console /entry main kernel32.dll msvcrt.dll ws2_32.dll connect64.obj /fo connect64.exe && connect64.exe
要么
nasm -f win64 connect64.s && link connect64.obj /SUBSYSTEM:CONSOLE /OUT:connect64.exe /ENTRY:main "C:\Program Files (x86)\Windows Kits\10\Lib\10.0.19041.0\um\x64\WS2_32.LIB" "C:\Program Files (x86)\Windows Kits\10\Lib\10.0.19041.0\um\x64\KERNEL32.LIB" "C:\Program Files (x86)\Windows Kits\10\Lib\10.0.19041.0\ucrt\x64\UCRT.LIB" "legacy_stdio_definitions.lib" /LARGEADDRESSAWARE:NO && connect64.exe
uj5u.com熱心網友回復：
Windows ABI 具有與此代碼相關的三個要求：
- rsp 在呼叫之前必須是 16 位元組對齊的。
- 呼叫前堆疊頂必須有32位元組的空閑空間，可以被呼叫函式自由使用。
- 前 4 個函式引數在 rcx、rdx、r8 和 r9 中，其余引數在從 rsp 0x20 開始的堆疊上。
呼叫程序時，呼叫會將 8 位元組的回傳地址壓入堆疊。因此，每個函式都必須將堆疊調整為 8 的奇數倍，以將其重新對齊到 16 位元組邊界。
顯示的代碼將最后兩個引數壓入堆疊，然后從堆疊指標中減去 0x30，因此壓入的兩個引數不在它們需要的位置 rsp 0x20。它應該減去 0x20。
一個更好的解決方案——編譯器使用的解決方案——是在函式的開頭從 rsp 中減去 0x38，而不是在函式內再次更改 rsp。mov qword [rsp 0x20], 0使用;初始化兩個引數 mov qword [rsp 0x28], 0而不是推動。
轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/447345.html