windows - 带有 User32.dll 的 LoadLibraryA 在 ntdll.dll(x64 程序集)中崩溃

Question

所以我有一个汇编代码块，它初始化一个程序，解析 kernel32，找到 GetProcAddress，然后找到 LoadLibarayA 来加载 User32.dll。它工作到 LoadLibraryA 为止。它在函数调用中崩溃，但我可以看到调试器中加载了 User32.dll。如果我尝试在不同的模块(例如 Kernel32.dll)上使用 LoadLibraryA，它会返回并成功。

如果你想看的话，这里有完整的源代码 https://gist.github.com/mojobojo/921a5af897e86bb940a2

Exception thrown at 0x00007FFAFAE8E91C (ntdll.dll) in Small.exe: 0xC0000005: Access violation reading location 0xFFFFFFFFFFFFFFFF.

这是尝试加载 user32 的片段。

    mov rcx, ActualAddress + User32DllStr ; ActualAddress is the program address in memory
    call rax ; LoadLibararyA
    cmp rax, 0
    je  EndFunction ; Failed to open user32.dll

LoadLibraryAStr:
    db "LoadLibraryA", 0

下面是调用栈。

ntdll.dll!RtlDosPathNameToRelativeNtPathName()  Unknown
ntdll.dll!LdrpResolveDllName()  Unknown
ntdll.dll!LdrpFindLoadedDll()   Unknown
ntdll.dll!LdrGetDllHandleEx()   Unknown
ntdll.dll!LdrGetDllHandle() Unknown
KernelBase.dll!00007ffaf82d2984()   Unknown
KernelBase.dll!00007ffaf82d29ef()   Unknown
user32.dll!00007ffaf934e7e8()   Unknown
user32.dll!00007ffaf934dc92()   Unknown
ntdll.dll!LdrpCallInitRoutine() Unknown
ntdll.dll!LdrpInitializeNode()  Unknown
ntdll.dll!LdrpInitializeGraph() Unknown
ntdll.dll!LdrpPrepareModuleForExecution()   Unknown
ntdll.dll!LdrpLoadDll() Unknown
ntdll.dll!LdrLoadDll()  Unknown
KernelBase.dll!00007ffaf82d8e4a()   Unknown
KernelBase.dll!00007ffaf82d97e5()   Unknown
kernel32.dll!00007ffaf8b5499a() Unknown
Small.exe!0000000140010253()    Unknown

Answer 1

我想通了。我的堆栈不是 16 字节对齐的。