c++ - 在不包含 windows.h 的情况下调用 kernel32.dll 函数

Question

如果保证kernel32.dll加载到进程虚拟内存中，为什么我不能在不包含windows.h的情况下调用诸如Sleep之类的函数？以下是 vividmachine.com 的摘录

5. So, what about windows? How do I find the addresses of my needed DLL functions? Don't these addresses change with every service pack upgrade?

There are multitudes of ways to find the addresses of the functions that you need to use in your shellcode. There are two methods for addressing functions; you can find the desired function at runtime or use hard coded addresses. This tutorial will mostly discuss the hard coded method. The only DLL that is guaranteed to be mapped into the shellcode's address space is kernel32.dll. This DLL will hold LoadLibrary and GetProcAddress, the two functions needed to obtain any functions address that can be mapped into the exploits process space. There is a problem with this method though, the address offsets will change with every new release of Windows (service packs, patches etc.). So, if you use this method your shellcode will ONLY work for a specific version of Windows. Further dynamic addressing will be referenced at the end of the paper in the Further Reading section.

Answer 1

你引用的那篇文章着重于获取函数的地址。您仍然需要函数的函数原型(prototype)(它不会跨版本更改)，以便生成调用函数的代码 - 适当处理输入和输出参数、寄存器值和堆栈。

windows.h 头文件提供了你希望调用给 C/C++ 编译器的函数原型(prototype)，这样调用函数的代码(传递可以通过寄存器或堆栈生成参数，并获取函数的返回值)。

通过阅读windows.h了解函数原型(prototype)后，熟练的汇编程序员也可以编写汇编代码来调用Sleep函数。连同函数的地址，这些就是进行函数调用所需的全部内容。