Question

是否可以将ESP手动设置为MSVC和Clang变量中存储的地址，而无需通过asm？

Answer 1

没有ASM，我怀疑是否有可能。至少在基于Linux的操作系统上，libc实现或内核设置是初始堆栈。我认为在Windows上，根据PE标头中的信息来设置堆栈是Loader的工作。您可以编写自己的Loader，并根据需要设置堆栈的设置，但更为复杂。

如果要操作堆栈，则必须覆盖堆栈指针和框架指针。

这是我为您编写的示例程序：

#include <stdio.h>
#include <unistd.h>
#ifdef __linux__
#include <sys/mman.h>
#endif
#ifdef _WIN32
#include <windows.h>
#endif
#define NEW_STACK_SIZE 1024
int fn_newstack(int arg0, void *arg1, const char *arg2) {
    /* let's test the new stack */
    int stack_var = 0xcafecafe;
    printf("subroutine: 0x%X, %d, %p, '%s'\n", stack_var, arg0, arg1, arg2);
    arg0 = 0;
    arg1 = NULL;
    arg2 = NULL;
    return 0x66;
}
int main(void) {
    {
        int some_stack_var = 0xdeadbeef;
        printf("(OLD-)Stack var: 0x%X (%p)\n", some_stack_var, &some_stack_var);
    }

    /* grab some memory for the new stack */
#ifdef __linux__
    unsigned long *newstack = (unsigned long *)
        mmap(NULL, NEW_STACK_SIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0);
#elif _WIN32
    unsigned long *newstack;
    {
        HANDLE fHandle = CreateFileMapping(INVALID_HANDLE_VALUE, NULL,
            PAGE_READWRITE | SEC_COMMIT, 0, NEW_STACK_SIZE, NULL);
        newstack = MapViewOfFile(fHandle, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0,
            NEW_STACK_SIZE);
        CloseHandle(fHandle);
    }
#else
#error "Whaaaaaat?"
#endif
    /* Stack grows backwards. */
    newstack += NEW_STACK_SIZE; /* 1024 bytes available for the new stack */
    printf("New Stackptr: %p\n", newstack);
    /* 
     * Set new stack ptr and create a new stack frame.
     */
    asm __volatile__("mov %%rsp,%%rbx;\n\t"
                    "mov %0,%%rsp;\n\t"
                    "push %%rbx;\n\t" /* save old stack ptr */
                    "push %%rbp;\n\t" /* save old frame ptr */
                    "mov %%rsp,%%rbp;\n\t"
                    /* 
                     * It seems like Linux GCC, MingW GCC and Clang uses a different stack alignment.
                     * GCC Linux: 0x40 , GCC MingW: 0x70 , Clang Linux: 0x80
                     */
                    "sub $0x80,%%rsp" : : "r"(newstack) : "rbx");
    /* after this point all "old" variable can not be used directly */

    {
        int some_stack_var = 0xdeadc0de;
        char text[] = "subroutine with a brand new stack";
        printf("(NEW-)Stack var #2: 0x%X (%p), '%s'\n", some_stack_var, &some_stack_var, text);
        printf("fn_newstack returned: 0x%X\n",
            fn_newstack(1, &some_stack_var, text));
    }

    /* restore old stack ptr */
    asm __volatile__("mov %%rbp,%%rsp;\n\t"
                    "pop %%rbp;\n\t"
                    "pop %%rsp" : : );

    return 0;
}

请记住：这是一个肮脏的解决方案，并非旨在在安全稳定的环境中工作。

编译适用于：

带有glibc-2.25的x86_64 GCC 6.3.0
带有musl-master的x86_64 GCC 6.3.0
带有glibc-2.25的x86_64 Clang 5.0
x86_64-w64-mingw32

经过测试：

Debian稳定版
葡萄酒1.8.7

/ * FIXME：很抱歉，我目前无法访问MSVC编译器。 * /

以编程方式在MSVC和Clang上设置堆栈指针

1 个答案: