Windows 初始执行上下文
一旦Windows将可执行文件加载到内存中并将执行转移到入口点，寄存器和堆栈中的值是否有意义？如果是这样，我在哪里可以找到有关它的更多信息？
Once Windows has loaded an executable in memory and transfert execution to the entry point, do values in registers and stack are meaningful? If so, where can I find more informations about it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
正式地，PE文件入口点的寄存器没有定义值。您应该使用 API（例如
GetCommandLine）来检索所需的信息。然而，由于最终将控制权转移到入口点的内核函数与以前相比并没有太大变化，一些PE加壳程序和恶意软件开始依赖它的特性。两个或多或少可靠的寄存器是：EAX 指向应用程序的入口点（因为内核函数使用
call eax跳转到它）EBX指向进程环境块（PEB）。
Officially, the registers at the entry point of PE file do not have defined values. You're supposed to use APIs, such as
GetCommandLineto retrieve the information you need. However, since the kernel function that eventually transfers control to the entry point did not change much from the old days, some PE packers and malware started to rely on its peculiarities. The two more or less reliable registers are:EAX points to the entry point of the application (because the kernel function uses
call eaxto jump to it)EBX points to the Process Environment Block (PEB).
《Windows 内部原理第五版》第 5 章详细介绍了 Windows 创建进程的机制。这将为您提供有关 Windows 在内存中加载可执行文件并将执行转移到入口点的更多信息。
我找到了这个最新的参考资料，其中介绍了如何在各种操作系统和各种编译器的各种调用约定中使用寄存器。它非常详细，而且看起来很全面：
Agner Fog 的调用约定文档
Chapter 5 of Windows Internals Fifth Edition covers the mechanism of Windows creating a process in detail. That would give you more information about Windows loading an executable in memory and transferring execution to the entry point.
I found this up-to-date reference that covers how registers are used in various calling conventions on various operating systems and by various compilers. It's quite detailed, and seems comprehensive:
Agner Fog's Calling Conventions document