在运行时确定汇编语言运行的操作系统有哪些技术？
在运行时确定汇编语言运行的操作系统有哪些技术？
如果有直接的方法来确定这一点，那就太棒了。
我也在思考 Javascript 中如何使用技巧来确定您正在运行的浏览器...是否有类似的技术可以用像英特尔汇编这样的低级语言来确定操作系统甚至 CPU 架构？
谢谢， 陈兹
What are techniques for determining running OS in assembly language at runtime?
If there are direct ways to determine this, that'd be awesome.
I was also thinking of how there are tricks in Javascript to determine what browser you're running in... Are there similar techniques for determining OS or even CPU arch in a low level language like Intel assembly?
Thanks,
Chenz
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
CPU 架构几乎无法确定。不同 CPU 架构之间的机器代码差异很大，因此编写不会在除一种架构之外的所有架构上崩溃的检测代码非常困难。事实上，您可以将汇编（和机器代码）视为不同 CPU 架构上完全不同的语言 - 任何可以探测的东西基本上都必须是机器代码多语言。
也就是说，如果您知道自己使用的是 x86 的某种风格，您也许可以使用 CPUID指令获取有关处理器功能的信息。您还可以读取控制寄存器来确定您是否处于 64 位模式。
至于检测操作系统，这也是相当困难的。不同的操作系统有不同的系统调用入口点，尝试使用错误的操作系统入口点只会导致崩溃（事实上，Windows 甚至在每次启动时都会改变系统调用入口点的地址）。您可能能够探测Windows的TIB - 但任何尝试访问
FS:[0x0]在其他操作系统上很可能会崩溃。一般来说，当您编写程序集时，您应该知道您所在的系统类型。如果您需要可移植性，请用 C 或其他高级语言编写。
CPU architecture will be next-to-impossible to determine. Machine code differs greatly between CPU architectures, and so it's very difficult to write detection code that won't simply crash on all but one architecture. Indeed, you can consider assembly (and machine code) to be an entirely different language on different CPU architectures - anything that can probe that would have to basically be a machine code polyglot.
That said, if you know you're on some flavor of x86, you might be able to use the CPUID instruction to get information on the processor capabilities. You might also be able to read control registers to figure out if you're in 64-bit mode.
As for detecting OS, this is also quite difficult. Different OSes have different system call entry points, and trying to use the wrong OS's entry point will just give you a crash (indeed, Windows even varies the address of the syscall entry points from one boot to the next). You might be able to probe for windows's TIB - but any attempt to access
FS:[0x0]may well crash on other OSes.Generally speaking, when you write assembly you're expected to know what kind of system you're on. If you need portability, write in C or some other high-level language.
不，没有机器代码可以让您执行此操作。您可以为您的病毒提供针对不同架构的几种不同的shellcode，每次传播时随机选择一个。如果它成功运行，它就会感染机器，但如果它是垃圾，你的进程可能会因为发出非法指令而被杀死，而用户又可以在健康的机器上生活了。
No, there is no machine code that will let you do this. You could give your virus several different shellcodes for different architectures, pick one at random each time it propagates. If it runs successfully it infects the machine, but if it's garbage your process probably gets killed for issuing an illegal instruction and the user lives another day with a healthy machine.
通常，您无法可靠地确定 C(++) 或汇编语言程序中的操作系统。
您可以使用不同操作系统版本中可用的某些功能来区分同一操作系统的不同“兼容”版本，例如
GetSystemInfo()/GetNativeSystemInfo()在 Windows 中，但这些在 DOS、Linux 和其他操作系统中不可用。这在汇编语言子例程中很难找到，因为在不同的操作系统上，调用操作系统函数的方式不同，如果您对操作系统的调用不正确，您的程序就会崩溃。为了防止它崩溃，您需要安装某种异常或信号处理程序，但这也是特定于操作系统的。
从通用 CPU 寄存器的内容推断操作系统也是不可靠的，因为它们的值不能保证以某种方式反映操作系统，即使在某些情况下它们碰巧发生，将来也可能会发生变化，包括在不久的将来更新时操作系统（例如安装安全补丁）。
您可以使用 C 的
system()函数执行 shell 命令，例如 Windows 的ver和 Linux 的uname -a，但是有没有可移植的方法来在控制台窗口中提取此命令的输出并将其复制回程序中进行分析。Generally you can't reliably determine the OS in a C(++) or assembly language program.
You may be able to distinguish between different "compatible" versions of the same OS using some of its functions that are available in those different OS versions like
GetSystemInfo()/GetNativeSystemInfo()in Windows, but those aren't available in DOS, Linux and other OSes.This is harder to find out in an assembly language subroutine because on different OSes there're different ways of calling OS functions and if you do it incorrectly for the OS, your program crashes. To prevent it from crashing you'd need to install some kind of exception or signal handler, but that too is OS-specific.
Inferring the OS from the contents of general-purpose CPU registers is also unreliable as their values aren't guaranteed to somehow reflect the OS and even if in some cases they happen to, that can change in the future, including near future when you update the OS (e.g. install security patches).
You may be able to execute a shell command such as
verfor Windows anduname -afor Linux using C'ssystem()function, but there's no portable way to extract the output from this command in the console window and copy it back into the program for analysis.