Скачать - Xakep Online

64-áèòíûé ôàéë —
ïåðâûé ïîëåò
òðàäèöèîííîãî: òîëüêî âñå îïåðàíäû è àäðåñà
ïî óìîë÷àíèþ 64-ðàçðÿäíûå, à ïàðàìåòðû APIôóíêöèé
ïåðåäàþòñÿ áîëüøåé ÷àñòüþ ÷åðåç
ðåãèñòðû, à íå ÷åðåç ñòåê. Ïåðâûå ÷åòûðå àðãóìåíòà
âñåõ API-ôóíêöèé ïåðåäàþòñÿ â ðåãèñòðàõ
RCX, RDX, R8 è R9 (ðåãèñòðû ïåðå÷èñëåíû
â ïîðÿäêå ñëåäîâàíèÿ àðãóìåíòîâ, êðàéíèé ëåâûé
àðãóìåíò ïîìåùàåòñÿ â RCX). À óæ îñòàëüíûå ïàðàìåòðû êëàäóòñÿ
â ñòåê. Âñå ýòî íàçûâàåòñÿ x86-64 fast calling conversion (ñîãëàøåíèå î
áûñòðîé ïåðåäà÷å ïàðàìåòðîâ äëÿ x86-64), ïîäðîáíîå îïèñàíèå êîòîðîé
ìîæíî íàéòè â ñòàòüå The history of calling conventions, part 5 amd64
(http://blogs.msdn.com/oldnewthing/archive/2004/01/14/58579.aspx). Òàêæå
ñîâåòóþ çàãëÿíóòü íà ñòðàíè÷êó áåñïëàòíîãî êîìïèëÿòîðà Free PASCAL
è ïîäíÿòü äîêóìåíòàöèþ ïî ñïîñîáàì âûçîâà API: http://www.freepascal.org/
wiki/index.php/Win64/AMD64_API.  ÷àñòíîñòè, âûçîâ ôóíêöèè ñ ïÿòüþ
àðãóìåíòàìè API_func(1,2,3,4,5) âûãëÿäèò òàê:
ðåãèñòðû, äîñòóïíûå â x86-64 ðåæèìå
ðåàêöèÿ 32-áèòíîé Windows íà ïîïûòêó
çàïóñêà 64-áèòíîãî PE-ôàéëà
çàãðóçêà 64-ðàçðÿäíîãî Äåáèàíà
ïîä ýìóëÿòîðîì QEMU
è áåëóþ ìàãèþ) äîòÿíóòüñÿ äî íèõ
íåëüçÿ è ïðåæäå ÷åì ÷òî-òî ñäåëàòü,
íåîáõîäèìî ïåðåâåñòè ïðîöåññîð â
äëèííûé ðåæèì (long mode), êîòîðûé
äåëèòüñÿ íà äâà ïîäðåæèìà: ðåæèì
ñîâìåñòèìîñòè ñ x86 (compatibility
mode) è 64-áèòíûé ðåæèì (64-bit
mode). Ðåæèì ñîâìåñòèìîñòè ïðåäóñìîòðåí
òîëüêî äëÿ òîãî, ÷òîáû 64-ðàçðÿäíàÿ
îïåðàöèîííàÿ ñèñòåìà ìîãëà
âûïîëíÿòü ñòàðûå 32-áèòíûå ïðèëîæåíèÿ.
Íèêàêèå 64-áèòíûå ðåãèñòðû
çäåñü è íå íî÷åâàëè! Ðåàëüíàÿ 64-áèòíîñòü
îáèòàåò òîëüêî â 64-bit long
mode, î êîòîðîì ìû è áóäåì ãîâîðèòü!
[hello world íà x86-64] Ïðîãðàììèðîâàíèå
ïîä 64-áèòíóþ âåðñèþ
Windows ìàëî ÷åì îòëè÷àåòñÿ îò
mov dword ptr [rsp+20h], 5
mov r9d, 4
mov r8d, 3
mov edx, 2
mov ecx, 1
call API_func
; êëàäåì íà ñòåê ïÿòûé ñëåâà àðãóìåíò
; ïåðåäàåì ÷åòâåðòûé ñëåâà àðãóìåíò
; ïåðåäàåì òðåòèé ñëåâà àðãóìåíò
; ïåðåäàåì âòîðîé ñëåâà àðãóìåíò
; ïåðåäàåì ïåðâûé ñëåâà àðãóìåíò
Ñìåùåíèå ïÿòîãî àðãóìåíòà îòíîñèòåëüíî âåðõóøêè ñòåêà òðåáóåò ïîÿñíåíèé.
Ïî÷åìó îíî ðàâíî 20h Âåäü àäðåñ âîçâðàòà çàíèìàåò òîëüêî 8
áàéò. Êàêàÿ ñó… ñóùíîñòü ñúåëà âñå îñòàëüíûå Îêàçûâàåòñÿ, îíè ðåçåðâèðóþòñÿ
äëÿ ïåðâûõ ÷åòûðåõ àðãóìåíòîâ, ïåðåäàííûõ ÷åðåç ðåãèñòðû.
Çàðåçåðâèðîâàííûå ÿ÷åéêè ñîäåðæàò íåèíèöèàëèçèðîâàííûé ìóñîð è ïîáóðæóéñêè
íàçûâàþòñÿ spill, ÷òî ïåðåâîäèòñÿ êàê çàòû÷êà èëè ïîòåðÿ.
Âîò ìèíèìóì çíàíèé, íåîáõîäèìûõ äëÿ âûæèâàíèÿ â ìèðå 64-áèòíîé
Windows ïðè ïðîãðàììèðîâàíèè íà àññåìáëåðå. Îñòàåòñÿ ðàçîáðàòü
ñàìóþ ìàëîñòü: êàê ýòè ñàìûå 64-áèòà çàïîëó÷èòü! Äëÿ ïåðåâîäà
FASM'à â x86-64 ðåæèì äîñòàòî÷íî óêàçàòü äèðåêòèâó use64 è äàëüøå
êîäèòü êàê îáû÷íî.
Íèæå èäåò ïðèìåð ïðîñòåéøåé x86-64 ïðîãðàììû, êîòîðàÿ íå äåëàåò
íè÷åãî, òîëüêî âîçâðàùàåò â ðåãèñòðå RAX çíà÷åíèå 0.
[XÀÊÅÐ 11 [83] 05 > ÊÎÄÈÍÃ 120]
ÏÅÐÅÕÎÄ Â 64-ÐÀÇÐßÄÍÛÉ ÐÅÆÈÌ
Êàê èçâåñòíî, â èñõîäíèêàõ FreeBSD
ìîæíî íàéòè ôàéë amd64_tramp.S,
áûñòðî è ãðÿçíî ïåðåâîäÿùèé
ïðîöåññîð â 64-ðåæèì. Îòêîìïèëèðîâàâ,
åãî ìîæíî çàïèñàòü â bootñåêòîð,
çàãðóæàþùèé íàøó
ñîáñòâåííóþ îïåðàöèîííóþ ñèñòåìó
(òû âåäü ïèøåøü åå, ïðàâäà),
èëè ñëèíêîâàòü com-ôàéë, çàïóñêàåìûé
èç ðåàëüíîãî x86-ðåæèìà (äëÿ
ýòîãî ïîòðåáóåòñÿ ÷èñòàÿ MS-DOS
áåçî âñÿêèõ ýêñòåíäåðîâ). Â îáùåì,
âàðèàíòîâ, êàê ñ ýòèì ñïðàâèòüñÿ,
äîâîëüíî ìíîãî.
[ïåðåâîä ïðîöåññîðà â 64-ðàçðÿäíûé ðåæèì]
//$FreeBSD: /repoman/r/ncvs/src/sys/boot/i386/
libi386/amd64_tramp.S,v 1.4 2004/05/14
/*
* Quick and dirty trampoline to get into 64 bit
(long) mode and running
* with paging enabled so that we enter the kernel
at its linked address.
*/
#define MSR_EFER 0xc0000080
#define EFER_LME 0x00000100
#define CR4_PAE 0x00000020
#define CR4_PSE 0x00000010
#define CR0_PG 0x80000000
/* GRRR. Deal with BTX that links us for a nonzero
location */
#define VPBASE
#define VTOP(x)
.data
.p2align 12,0x40
.globl PT4
PT4:
.space
.globl PT3
PT3:
.space 0x1000
.globl PT2
PT2:
.space
0xa000
((x) + VPBASE)
0x1000
0x1000
gdtdesc:
.word gdtend - gdt
.long VTOP(gdt) # low
.long0
# high
gdt:
.long 0 # null descriptor
.long 0
.long 0x00000000 # %cs
.long 0x00209800
.long 0x00000000 # %ds
.long 0x00008000
gdtend:
.text
.code32
.globl amd64_tramp
amd64_tramp:
/* Be sure that interrupts are disabled */
cli
/* Turn on EFER.LME */
movl $MSR_EFER, %ecx
rdmsr
orl $EFER_LME, %eax
wrmsr
/* Turn on PAE */
movl %cr4, %eax
orl $(CR4_PAE | CR4_PSE), %eax
movl %eax, %cr4
/* Set %cr3 for PT4 */
movl $VTOP(PT4), %eax
movl %eax, %cr3
/* Turn on paging (implicitly sets EFER.LMA) */
movl %cr0, %eax
orl $CR0_PG, %eax
movl %eax, %cr0
movl
movl
movl
lgdt
ljmp
$VTOP(gdtdesc), %eax
VTOP(entry_hi), %esi
VTOP(entry_lo), %edi
(%eax)
$0x8, $VTOP(longmode)
.code64
longmode:
movl %esi, %eax
salq $32, %rax
orq %rdi, %rax
pushq %rax
ret