x64内存注入，1-2后闪退

dnxl

可以试下这段X64CALL

置入代码({106,51,232,0,0,0,0,131,4,36,5,203,72,99,237,102,129,228,240,255,72,49,192,139,69,16,133,192,116,69,68,139,85,20,77,99,210,73,139,10,131,232,1,133,192,116,52,73,139,82,8,131,232,1,133,192,116,41,77,139,66,16,131,232,1,133,192,116,30,77,139,74,24,131,232,1,133,192,116,19,168,1,117,3,131,236,8,65,255,116,194,24,131,232,1,133,192,117,244,131,236,32,255,85,8,72,137,194,72,193,234,32,232,0,0,0,0,199,68,36,4,35,0,0,0,131,4,36,13,203,201,194,16,0})

易里面的原型差不多这样，我一般不用易语言，这个版本是改到VB6里面用的，没发现在什么问题。

、
汇编

yinxixi

966666666666666666666666666

将来啊

同学麻烦让让 发表于 2021-12-2 09:37
他这个CALL写的有问题，X64调用约定前四个参数用RCX,RDX,R8和R9传递，后面的参数是需要通过mov qword[rsp+2 ...

大佬说的很对，这两天我在研究FastCall 刚搞明白参数传递 早看到你这个回复的话 都省的我去翻资料了。