呼叫WinApi函式后RIP損壞

在我呼叫 CreateWindowExA 后，我的 RIP 出錯了，但在我通過 x64dbg 發現的 NtUserCreateWindowEx 之后它已損壞，也許我在堆疊分配方面做錯了。

有我的代碼：

include win64a.inc

.code
WinMain proc
push rbp                        ; save old rbp
mov rbp, rsp                    ; set-up rbp
sub rsp, 20h                    ; allocate space for local vars
mov rcx, 0                      ; 1 param
mov rdx, IDC_ARROW              ; 2 param 
sub rsp, 20h                    ; allocate home-space
call LoadCursorA                
mov [rbp - 8h], rax             ; 1 local param, hCursor 
mov rcx, 0                      ; 1 param
mov rdx, IDI_APPLICATION        ; 2 param
call LoadIconA                  ; home-space allocated at 11 
mov [rbp - 10h], rax            ; 2 local param, hIcon
add rsp, 20h                    ; deallocate home-space
; Develope WNDCLASSEXA structure
push [rbp-10h]                  
pushaddr wndName
push 0
push COLOR_WINDOWFRAME
push [rbp-8h]
push [rbp-10h]
push IMAGE_BASE
push 0
pushaddr WndProc
push sizeof WNDCLASSEX

mov rcx, rsp                    ; 1 param - ptr to the structure
sub rsp, 20h                    ; allocate home-space
call RegisterClassExA
sub rsp, 40h                                ; Allocate stack for params
xor rcx, rcx                                ; dwExStyle
lea rdx, wndName                            ; lpClassName
lea r8, wndName                             ; lpWindowName
mov r9, WS_OVERLAPPEDWINDOW or WS_VISIBLE   ; dwStyle
mov qword ptr [rsp   20h], 0                ; x
mov qword ptr [rsp   28h], 0                ; y
mov qword ptr [rsp   30h], 600              ; w
mov qword ptr [rsp   38h], 800              ; h
mov qword ptr [rsp   40h], 0                ; hWndParent
mov qword ptr [rsp   48h], 0                ; hMenu
mov qword ptr [rsp   50h], IMAGE_BASE       ; hInstance
mov qword ptr [rsp   58h], 0                ; lpParam
call CreateWindowExA
add rsp, 40h                                ; Deallocate stack
mov [rbp-18h], rax                          ; 3 local param, hWnd
leave
WinMain endp

WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
WndProc endp

.data
wndName db "test", 0
end

在 win64a.inc 中：

OPTION DOTNAME
OPTION PROLOGUE:rbpFramePrologue
OPTION EPILOGUE:rbpFrameEpilogue
include win64.inc
include temphls.inc
include ntdll.inc
includelib ntdll.lib
include user32.inc
includelib user32.lib
include gdi32.inc
includelib gdi32.lib
include kernel32.inc
includelib kernel32.lib
include shell32.inc
includelib shell32.lib
;---------------------------
pushaddr macro x
    db 68h
    dd x
endm
IMAGE_BASE  equ 400000h

所以我研究并繪制了堆疊分配的圖形，這對我來說完全沒問題，我有什么問題嗎？

在它呼叫 NtUserCreateWindowEx RIP 損壞后，我有這樣的事情：

而且我使用 Invoke 宏創建版本并導致相同的錯誤：（我使用 MASM64

和 CreateWindowExA 呼叫之前的引數：

和 ml64.exe / link.exe 選項：

1. ml64.exe /I"%masm64_path%/include" /Zp16 /c /Cp %filename%.asm >>errors.txt
   

2. link /LIBPATH:"%masm64_path%\lib" /LARGEADDRESSAWARE:NO /SUBSYSTEM:WINDOWS ^
    /STUB:%masm64_path%\bin\stubby.exe ^
    /entry:WinMain /fixed %filename%.obj
   

uj5u.com熱心網友回復：

Michael Petch & bitRAKE 說這個問題是因為在函式回傳之前NtUserCreateWindowEx呼叫WndProc函式，所以我需要創建完整WndProc的堆疊處理。所以我添加了這個leave，它現在可以作業了。

Wndproc proc <12,8,4,8,8> hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
leave                   ;<----------- Added to resolve issue
jmp NtdllDefWindowProc_
ret
Wndproc endp

標籤：Intel Collective 部件温纳皮x86-64调用约定masm64

上一篇：為什么超時引數在GetAddrInfoExW()中不起作用？

下一篇：任意長二進制字串的UTF-16表示