文章总结： 本文推荐Windowsx64汇编与Shellcode入门教程，并展示了通过汇编动态获取kernel32基址、解析导出表调用WinExec执行calc.exe的代码实例。作者指出汇编难点在于PE结构、TEB与PEB等底层知识，鼓励读者坚持学习。
综合评分： 74
文章分类： 二进制安全,漏洞POC,逆向分析,实战经验

Windows x64汇编

原创

ybdt
ybdt

卡卡罗特取西经

2026年3月13日 22:18
吉林

学完王爽老师的Windows 16位汇编、罗云彬老师的Windows 32位汇编，最后就是Windows x64汇编，下面这个系列是我觉得不错的学习资源

【x64汇编与shellcode入门教程&nbsp;01】https://mp.weixin.qq.com/s/HzEWKEpYpeBNJyk4IEll2g?scene=1【x64汇编与shellcode入门教程 02】https://mp.weixin.qq.com/s/vEfsmgBpEOJSzvXcvnEtUA?scene=1【x64汇编与shellcode入门教程 03】https://mp.weixin.qq.com/s/bJnqwt0_9rQCmaYZFrcFKg?scene=1【x64汇编与shellcode入门教程 04】https://mp.weixin.qq.com/s/-SEK85Fflt-Gr_Km9YcD3w?scene=1【x64汇编与shellcode入门教程 05】https://mp.weixin.qq.com/s/xC02bij37DTr_j4arJi_ag?scene=1【x64汇编与shellcode入门教程 06】https://mp.weixin.qq.com/s/db2pQXBx44IF4Dst0hw9sQ?scene=1【x64汇编与shellcode入门教程 07】https://mp.weixin.qq.com/s/AmjTv9wzFqzV1GKZYUecNQ

原文在这里：https://g3tsyst3m.com/shellcoding/assembly/debugging/x64-Assembly-and-Shellcoding-101/

翻译的质量不错，都很准确，当然你想看原文也可以

直接上代码，Windows x64汇编实现动态获取kernel32.dll地址，解析kernel32.dll导出表后定位WinExec，最后通过WinExec执行calc.exe

代码中包含了详细注释，我就不再赘述解释了

; nasm&nbsp;-fwin64 x64findkernel32.asm; ld&nbsp;-m i386pep&nbsp;-o x64findkernel32.exe x64findkernel32.obj
BITS&nbsp;64SECTION .textglobal&nbsp;mainmain:

;&nbsp;get&nbsp;the base address&nbsp;of&nbsp;kernel32.dll&nbsp;by&nbsp;gs segment registersub rsp,&nbsp;0x28and&nbsp;rsp,&nbsp;0xfffffffffffffff0xor rcx, rcx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; rcx&nbsp;=&nbsp;0&nbsp; &nbsp;mov rax, [gs:rcx&nbsp;+&nbsp;0x60] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; gs contain the base address&nbsp;of&nbsp;TEB,&nbsp;and&nbsp;offset&nbsp;0x60&nbsp;is&nbsp;the base address&nbsp;of&nbsp;PEBmov rax, [rax&nbsp;+&nbsp;0x18] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;offset&nbsp;0x18&nbsp;is&nbsp;the base address&nbsp;of&nbsp;PEB->Ldrmov rsi, [rax&nbsp;+&nbsp;0x10] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;offset&nbsp;0x10&nbsp;is&nbsp;the base address&nbsp;of&nbsp;PEB->Ldr->InLoadOrderModuleListmov rsi, [rsi] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; jump&nbsp;to&nbsp;next node&nbsp;of&nbsp;linked list PEB->Ldr->InLoadOrderModuleList, ntdll.dllmov rsi, [rsi] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; jump&nbsp;to&nbsp;next node&nbsp;of&nbsp;linked list &nbsp;PEB->Ldr->InLoadOrderModuleList, kernel32.dllmov rbx, [rsi&nbsp;+&nbsp;0x30] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;offset&nbsp;0x30&nbsp;is&nbsp;the base address&nbsp;of&nbsp;kernel32.dllmov r8, rbx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; the&nbsp;value&nbsp;of&nbsp;rbx assign&nbsp;to&nbsp;r8
; parse pe file header&nbsp;and&nbsp;export&nbsp;table&nbsp;to&nbsp;locate WinExec addressmov ebx, [rbx+0x3C] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; pe file&nbsp;offset&nbsp;0x3c&nbsp;contains&nbsp;nt headers addressadd&nbsp;rbx, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; relative address&nbsp;+&nbsp;base addressmov edx, [rbx+0x88] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; nt headers&nbsp;offset&nbsp;0x88&nbsp;contains&nbsp;export directory addressadd&nbsp;rdx, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; relative address&nbsp;+&nbsp;base addressmov r10d, [rdx+0x14] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; Total count&nbsp;for&nbsp;number&nbsp;of&nbsp;functionsxor r11, r11 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; clear R11&nbsp;mov r11d, [rdx+0x20] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; AddressOfNames&nbsp;=&nbsp;RVAadd&nbsp;r11, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfNames&nbsp;=&nbsp;VMAmov rcx, r10 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; setup loop countermov rax,&nbsp;0x00636578456E6957&nbsp; &nbsp; &nbsp; &nbsp;; "WinExec" string&nbsp;NULL&nbsp;terminated&nbsp;with&nbsp;a&nbsp;'0'&nbsp;push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push&nbsp;to&nbsp;the stackmov rax, rsp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; move stack pointer&nbsp;to&nbsp;our WinExec string&nbsp;into&nbsp;RAXadd&nbsp;rsp,&nbsp;8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; keep&nbsp;with&nbsp;16&nbsp;byte stack alignment
kernel32findfunction:&nbsp; &nbsp; jecxz FunctionNameNotFound &nbsp; &nbsp;; If ecx&nbsp;is&nbsp;zero (function&nbsp;not&nbsp;found),&nbsp;set&nbsp;breakpoint&nbsp; &nbsp; xor ebx, ebx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; Zero EBX&nbsp; &nbsp; mov ebx, [r11+rcx*4] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; EBX&nbsp;=&nbsp;RVA&nbsp;for&nbsp;first&nbsp;AddressOfName&nbsp; &nbsp;&nbsp;add&nbsp;rbx, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; RBX&nbsp;=&nbsp;Function&nbsp;name VMA&nbsp;/&nbsp;add&nbsp;kernel32 base address&nbsp;to&nbsp;RVA&nbsp;to&nbsp;get&nbsp;WinApi name&nbsp; &nbsp;&nbsp;dec&nbsp;rcx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; Decrement our loop&nbsp;by&nbsp;one, this goes&nbsp;from&nbsp;Z&nbsp;to&nbsp;A&nbsp; &nbsp; mov r9, qword [rax] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; R9&nbsp;=&nbsp;"WinExec"&nbsp; &nbsp; cmp [rbx], r9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; Compare&nbsp;all&nbsp;bytes&nbsp; &nbsp; jz FunctionNameFound &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; jump if zero flag&nbsp;is&nbsp;set&nbsp;(found&nbsp;function&nbsp;name!)&nbsp; &nbsp; jnz kernel32findfunction &nbsp; &nbsp; &nbsp;; didn't find the name, so keep loopin til we do!
FunctionNameFound:&nbsp; &nbsp; push rcx&nbsp; &nbsp; jmp OrdinalLookupSetup
FunctionNameNotFound:&nbsp; &nbsp; int3
OrdinalLookupSetup:&nbsp; &nbsp; pop r15&nbsp; &nbsp; js OrdinalLookup
OrdinalLookup:&nbsp; &nbsp; mov rcx, r15 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; move our function's place&nbsp;into&nbsp;RCX&nbsp; &nbsp; xor r11, r11 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; clear R11&nbsp;for&nbsp;use&nbsp; &nbsp; mov r11d, [rdx+0x24] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; AddressOfNameOrdinals&nbsp;=&nbsp;RVA&nbsp; &nbsp;&nbsp;add&nbsp;r11, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfNameOrdinals&nbsp;=&nbsp;VMA&nbsp; &nbsp; inc rcx&nbsp; &nbsp; mov r13w, [r11+rcx*2] &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfNameOrdinals&nbsp;+&nbsp;Counter. RCX&nbsp;=&nbsp;counter&nbsp; &nbsp; xor r11, r11&nbsp; &nbsp; mov r11d, [rdx+0x1c] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; AddressOfFunctions&nbsp;=&nbsp;RVA&nbsp; &nbsp;&nbsp;add&nbsp;r11, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; AddressOfFunctions VMA&nbsp;in&nbsp;R11. Kernel32+RVA&nbsp;for&nbsp;function&nbsp;addresses&nbsp; &nbsp; mov eax, [r11+r13*4] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;&nbsp;function&nbsp;RVA.&nbsp; &nbsp;&nbsp;add&nbsp;rax, r8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; Found the WinExec Api address!!!&nbsp; &nbsp; push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; Store&nbsp;function&nbsp;addresses&nbsp;by&nbsp;pushing it temporarily&nbsp; &nbsp; js executeit
;&nbsp;call&nbsp;WinExecexecuteit:pop r15 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; address&nbsp;for&nbsp;WinExecmov rax,&nbsp;0x00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push&nbsp;null&nbsp;string terminator&nbsp;'0'push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push it onto the stackmov rax,&nbsp;0x6578652E636C6163&nbsp; &nbsp; &nbsp; &nbsp;; move string&nbsp;'calc.exe'&nbsp;into&nbsp;RAX&nbsp;push rax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; push string&nbsp;+&nbsp;null&nbsp;terminator&nbsp;to&nbsp;stackmov rcx, rsp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; RDX points&nbsp;to&nbsp;stack pointer "WinExec" (1st&nbsp;parameter))mov rdx,&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; move&nbsp;1&nbsp;(show&nbsp;window&nbsp;parameter)&nbsp;into&nbsp;RDX (2nd&nbsp;parameter)sub rsp,&nbsp;0x30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; align stack&nbsp;16&nbsp;bytes&nbsp;and&nbsp;allow&nbsp;for&nbsp;proper setup&nbsp;for&nbsp;shadow space demandscall&nbsp;r15 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;&nbsp;Call&nbsp;WinExec!!

说一点感悟，常说的汇编难，其实难在它背后藏了很多知识，比如Windows PE中的导出表、再比如通过TEB、PEB的结构体，这些不懂的话，肯定看不懂汇编，不过路虽远，行则将至，再难的知识只要去学也能学会

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：卡卡罗特取西经 ybdt
ybdt《Windows x64汇编》

Tags: 二进制安全实战经验漏洞POC 逆向分析

你可能错过

别再把告警处理时长当MTDR！

1.2 万星标的 AI 红队神器，门没锁

产业协同集聚新发现：供应链与技能关联的“超加性”，重新理解企业扎堆

对一款 Linux 木马开源提示词的测评