X86 机器上的汇编、Windows 与 Linux
它们是一样的吗？
更长的版本：
假设我在 Windows 机器上用汇编编写了一个小应用程序，它所做的就是添加 1+1 并将其存储在寄存器中。然后，我在 Linux 机器上编写完全相同的代码。会起作用吗？
我想是的，因为在硬件层面，它是同一台机器，所以“硬件语言”（请原谅不精确）将是相同的。
因此，我认为针对 Windows 但以汇编语言编写的病毒不仅仅是 Windows 病毒。
Are they the same?
Longer version :
Say I wrote, in assembly, on a windows machine, a small app that all it does is add 1+1 and stores it in a register. THEN, I write the exact same code on a Linux machine. Would it work?
Im thinking yes, because at the hardware level, its the same machine, so the 'language of the hardware' (forgive the inexactness) would be the same.
So Im thinking a virus targeting windows but written in assembly wouldnt just be a windows virus.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
病毒肯定需要与操作系统交互并使用其 API。因此它高度依赖于平台。
此外，可执行文件还有一个标头，这取决于目标操作系统。如果您在 Windows 中创建一个或多或少为空的 EXE 文件，则该文件将无法在 Linux 下运行（甚至无法启动）。
A virus will most certainly need to interact with the operating system, and use its API. Hence it is highly platform-dependant.
In addition, an executable also has a header, and this will depend on the targeted OS. If you would create a more or less empty EXE file in Windows, this would not run (not even start) under Linux.
是和不是。
添加 1+1 并将其存储在寄存器中的小片段将是完全相同的机器代码 - 也就是说，无论操作系统是什么，在处理器上运行的代码都是相同的。
但是，您需要用与操作系统交互的其他位包围该代码，以使您的程序有意义 - 您永远不会知道您的代码实际上正确地将
2存储在eax中例如，如果它没有输出到某个地方。有趣的是，像 Wine 这样的项目通过在 Linux 下提供程序期望在 Windows 下找到的相同 API 调用来实现跨平台互操作性，并提供适当的逻辑以允许 Linux 正确解码 Windows 可执行文件。因此，有了Wine的支持，一些Windows病毒实际上可以在Windows下运行。这可能需要一些工作，但你可以实现它。
不，Wine 不必重新编译 Windows 程序——事实上，它直接在处理器上运行存储在 EXE 中的机器代码。
Yes and no.
The small snippet that adds 1+1 and stores it in a register is going to be exactly the same machine code -- that is, the code that run on the processor is the same no matter what the operating system.
However, you need to surround that code with other bits that interact with the OS to make your program meaningful -- you would never know that your code actually correctly stored
2ineaxif it didn't output to somewhere, for example.Interestingly, projects like Wine allow for cross-platform interoperability by providing under Linux the same API calls that the program would expect to find under Windows, as well as providing the appropriate logic to allow Linux to properly decode a Windows executable. So, with Wine support, some Windows viruses can actually run under Windows. It may take some work, but you can make it happen.
And no, Wine doesn't have to recompile the Windows programs -- it does, in fact, run the machine code stored in the EXEs directly on the processor.
在Windows上用汇编程序编写的程序与Linux不兼容...您需要在Linux上再次编译（汇编）它们，但请记住汇编程序之间存在差异..它们以不同的方式处理例如声明代码、数据的部分, bss
windows execs 不在 linux 上本地运行（你可以在 wine 中运行它们，但它们将被沙箱化）
programs written in assembler on windows are not binary compatible with linux... you need to compile(assemble) them again on linux, but keep in mind that there are differences between assemblers.. they differently handle for example parts for declaring code, data, bss
windoes execs don't run natively on linux (you can run them in wine, but they are gonna be sandboxed)
语言本身几乎相同，但操作指令不同。教程位于 http://asm.sourceforge.net/intro/hello.html对此有一个很好的解释。
section .text global _start ;must be declared for linker (ld) _start: ;tell linker entry point mov edx,len ;message length mov ecx,msg ;message to write mov ebx,1 ;file descriptor (stdout) mov eax,4 ;system call number (sys_write) int 0x80 ;call kernel mov eax,1 ;system call number (sys_exit) int 0x80 ;call kernel section .data msg db 'Hello, world!',0xa ;our dear string len equ $ - msg ;length of our dear string这与 DOS hello world 程序不同，因为操作系统特定的东西（如 int 0x80）。
The language itself is pretty much the same, but the operator instructions are different. The tutorial at http://asm.sourceforge.net/intro/hello.html has a pretty good explanation of this.
section .text global _start ;must be declared for linker (ld) _start: ;tell linker entry point mov edx,len ;message length mov ecx,msg ;message to write mov ebx,1 ;file descriptor (stdout) mov eax,4 ;system call number (sys_write) int 0x80 ;call kernel mov eax,1 ;system call number (sys_exit) int 0x80 ;call kernel section .data msg db 'Hello, world!',0xa ;our dear string len equ $ - msg ;length of our dear stringThis is different than the DOS hello world program because of the OS specific things(like int 0x80).
尽管您可能正在编写 x86 汇编程序，但您仍然会使用不同的汇编程序，具体取决于您使用的操作系统，并且它们将具有不同的功能，因此在 Windows 上用汇编程序编写不一定与您的相同我会在 Linux 中编写，尽管我认为它们会非常相似。
Although you may be writing x86 assembly, you'll still be using a different assembler depending on which operating system you are using, and they'll have different features, so writing in assembler on Windows wouldn't necessarily be the same as what you'd write in Linux, though I'd assume they'd be rather similar.
汇编语言在很大程度上是相同和相似的。然而，Windows 和 Linux 都不会尝试执行任意文件。大多数现代操作系统拒绝执行程序，除非它具有适当的可执行头（例如PE或ELF）。
在Windows 中，文件需要具有正确的扩展名（例如.exe、.dll、.com），并且在Windows 尝试执行文件之前，文件的布局需要符合可移植可执行文件(PE) 格式。
在Linux中，文件需要符合ELF格式（可执行和可链接格式）并具有执行权限位（可以使用chmod设置/取消设置）。
实际上，这意味着不识别 ELF 格式的 Windows 将拒绝执行 Linux 程序； Linux 将拒绝执行 PE/Windows 程序，除非您有 Wine。用汇编语言编写的病毒需要重新汇编（通过汇编程序运行）为正确的可执行格式（PE 或 ELF）以适应操作系统。
之后，就会出现Windows和Linux之间（甚至不同版本的Windows和不同版本的Linux之间）函数调用约定不同的问题；还有不同的系统调用 API 集和不同的方法来执行系统调用，甚至是最基本的事情。实际上，编写可在 Windows 和 Linux 之间移植的汇编代码几乎是不可能的，因为即使是打印输入/输出等基本操作也是不同的。
The assembly language is largely the same and similar. However, neither Windows nor Linux would try to execute an arbitrary file. Most modern operating system refuses to execute a program, unless it have the proper executable headers (e.g. PE or ELF).
In Windows, a file needs to have the correct extension (e.g. .exe, .dll, .com) and the file need to be layout conforming to the Portable Executable (PE) format before Windows even attempt to execute the file.
In Linux, a file needs to conform to the ELF format (Executable and Linkable Format) and have the execute permission bit (can be set/unset using chmod).
In practice, this means Windows which doesn't recognize ELF format would refuse to execute a Linux program; and Linux will refuse to execute a PE/Windows program unless you have Wine. A virus written in assembly would need to be reassembled (be run through the assembler) to the correct executable format (PE or ELF) to suit the OS.
After that, then you have the problem of differing function call convention between Windows and Linux (and even between different versions of Windows and different version of Linux); also different set of System Call API and different methods to do system calls for even the most basic things. In practice, it is near impossible to write an assembly code that is portable between Windows and Linux, since even basic operations like printing Input/Output is different.
x86 指令也会做同样的事情。
但事物在内存中的位置以及代码可以访问的内容会有所不同。
操作系统服务会有所不同，因为您调用它们的方式不同。
因此，如果您可以在两者上获得相同的二进制代码，那么您可以编写代码来将 1 到 100 之间的所有数字相加，这样就可以工作，但是打印出来的机制会有很大差异。
The x86 instructions will do the same thing.
But where things are located in memory will be different, and what your code can access.
Operating system services will be different as it how you invoke them.
So if you could get the same binary code on both then you could for example write code to add up all the numbers from 1-100 and that would work, but the mechanism for printing that out would vary considerably.
以下引自：Linux Intel 汇编语言简介
其他操作系统下的情况类似。例如，使用Microsoft或Turbo编译器，汇编语言源文件的后缀为.asm，目标文件的后缀为.obj等。
NASM 可用于 Unix 和 MS Windows。就此而言，甚至 as 也可以在 Windows 下使用，因为它是 gcc 软件包的一部分，并且可以在 Windows 下使用cygwin。
The following are quotes from: Introduction to Linux Intel Assembly Language
Things are similar under other operating systems. Using the Microsoft or Turbo compilers, for example, assembly language source files have the suffix .asm, object files have the suffix .obj, etc.
NASM is available for both Unix and MS Windows. For that matter, even as can be used under Windows, since it is part of the gcc package and that is available for Windows under the name cygwin.
所有操作系统的程序集可以是相同的，假设有可移植层以及您支持的每个操作系统的实现。
不过，如果您像我一样计划超级兼容的二进制文件.. ELF 和 PE 格式彼此完全不同，它将阻止相同的可执行文件在不同的操作系统上运行。尽管这可以通过编写便携式程序加载器来解决。
The assembly for all operating systems can be same, assuming there's portability layer with implementations for every operating system you're supporting.
Though, if you're planning about super-compatible binaries like I do.. ELF and PE -formats are entirely different from each other, and it will prevent same executable from running on different operating systems. Though this can be solved by writing a portable program loader.
它是相同的处理器，因此执行加法 1+1 的说明相同。是的。
并且您可能可以使用足够相似的工具来至少为该指令提供相同的汇编源。但是可执行文件格式（不仅包含要执行的字节，还包含其他内容）在操作系统之间是不同的。使用不同的工具来创建不同的可执行文件/容器。也就是说，如果您正在尝试执行一个完整的程序。如果您有病毒或其他邪恶程序，它们利用操作系统中的某些 malloc，其中有一种方法可以让操作系统执行代码，那么该代码的字节不会包含此可执行包装程序，这些字节是只是您想要运行的指令。因此，从这个意义上说，它们将再次是相同的字节，但是进入操作系统（或驱动程序）的漏洞利用可能依赖于操作系统，并且您的漏洞利用将依赖于操作系统。
It is the same processor and as a result the same instructions for doing your add 1+1 yes.
and it is likely possible that you can use similar enough tools to have the same assembly source at least for that instruction. But the executable file format, which contains not only the bytes to be executed but other stuff are different between the operating systems. Different tools are used to create the different executable files/containers. That is if you are trying to execute a complete program. If you have a virus or other evil program that takes advantage of some malloc in the operating system where there is a way to get the OS to execute code, well the bytes of that code are not going to contain this executable wrapper, those bytes are just the instructions you want to run. So in that sense they would again be the same bytes, but the exploit to get into the operating system (or a driver), is likely operating system dependent and your exploit would be operating system dependent.