汇编《Native app 的学习》

关于这方面的文章可以参考98年MarkRussinovich的文章，不多说了框架很简单.

 
ENVIRONMENT_INFORMATION STRUCT
    Unknown DD 21 DUP (?)
    CommandLine     UNICODE_STRING<>
    ImageFile UNICODE_STRING <>
ENVIRONMENT_INFORMATION ENDS

PSTARTUP_ARGUMENT STRUCT
    Unknown DD 3 DUP (?)
    Environment ENVIRONMENT_INFORMATION <>
PSTARTUP_ARGUMENT ENDS

.const
CCOUNTED_UNICODE_STRING "123456789101234567891012345678910", g_pTxt, 4

.code

start:
NtProcessStartup proc Argument:PSTARTUP_ARGUMENT

 
 invoke NtDisplayString,addr g_pTxt
 invoke NtTerminateProcess,NtCurrentProcess,0

 ret
 NtProcessStartup endp
end start