java 调用native api_Windows和Native API中的系统调用？

我有兴趣在没有导入的程序集中进行Windows API调用(作为教育练习)，所以我编写了以下FASM程序集来执行NtDll！NtCreateFile所做的事情 . 这是我的64位版本的Windows(Win10 1803版本10.0.17134)的粗略演示，它在调用后崩溃，但系统调用的返回值为零，因此它成功 . 根据Windows x64调用约定设置所有内容，然后将系统调用号加载到RAX中，然后运行调用的是系统调用程序集指令 . 我的示例创建了文件c：\ HelloWorldFile_FASM，因此必须以“管理员”身份运行 .

format PE64 GUI 4.0

entry start

section '.text' code readable executable

start:

;puting the first four parameters into the right registers

mov rcx, _Handle

mov rdx, [_access_mask]

mov r8, objectAttributes

mov r9, ioStatusBlock

;I think we need 1 stack word of padding:

push 0x0DF0AD8B

;pushing the other params in reverse order:

push [_eaLength]

push [_eaBuffer]

push [_createOptions]

push [_createDisposition]

push [_shareAcceses]

push [_fileAttributes]

push [_pLargeInterger]

;adding the shadow space (4x8)

; push 0x0

; push 0x0

; push 0x0

; push 0x0

;pushing the 4 register params into the shadow space for ease of debugging

push r9

push r8

push rdx

push rcx

;now pushing the return address to the stack:

push endOfProgram

mov r10, rcx ;copied from ntdll!NtCreateFile, not sure of the reason for this

mov eax, 0x55

syscall

endOfProgram:

retn

section '.data' data readable writeable

;parameters------------------------------------------------------------------------------------------------

_Handle dq 0x0

_access_mask dq 0x00000000c0100080

_pObjectAttributes dq objectAttributes ; at 00402058

_pIoStatusBlock dq ioStatusBlock

_pLargeInterger dq 0x0

_fileAttributes dq 0x0000000000000080

_shareAcceses dq 0x0000000000000002

_createDisposition dq 0x0000000000000005

_createOptions dq 0x0000000000000060

_eaBuffer dq 0x0000000000000000 ; "optional" param

_eaLength dq 0x0000000000000000

;----------------------------------------------------------------------------------------------------------

align 16

objectAttributes:

_oalength dq 0x30

_rootDirectory dq 0x0

_objectName dq unicodeString

_attributes dq 0x40

_pSecurityDescriptor dq 0x0

_pSecurityQualityOfService dq securityQualityOfService

unicodeString:

_unicodeStringLength dw 0x34

_unicodeStringMaxumiumLength dw 0x34, 0x0, 0x0

_pUnicodeStringBuffer dq _unicodeStringBuffer

_unicodeStringBuffer du '\??\c:\HelloWorldFile_FASM' ; may need to "run as adinistrator" for the file create to work.

ioStatusBlock:

_status_pointer dq 0x0

_information dq 0x0

securityQualityOfService:

_sqlength dd 0xC

_impersonationLevel dd 0x2

_contextTrackingMode db 0x1

_effectiveOnly db 0x1, 0x0, 0x0

我使用了Ntdll！NtCreateFile的文档，我还使用内核调试器查看并复制了很多参数 .

__kernel_entry NTSTATUS NtCreateFile(

OUT PHANDLE FileHandle,

IN ACCESS_MASK DesiredAccess,

IN POBJECT_ATTRIBUTES ObjectAttributes,

OUT PIO_STATUS_BLOCK IoStatusBlock,

IN PLARGE_INTEGER AllocationSize OPTIONAL,

IN ULONG FileAttributes,

IN ULONG ShareAccess,

IN ULONG CreateDisposition,

IN ULONG CreateOptions,

IN PVOID EaBuffer OPTIONAL,

IN ULONG EaLength

);