是否有 Win32 的 API 允许我使用 ES、GS、FS？
我想在汇编程序中使用 ES、FS 和 GS，以允许我拥有 3 个独立的地址空间。
是否有 Win32 API 可以设置 LDT 并为我提供适当选择器的值？
I would like to use ES, FS, and GS in an assembler program to allow me to have 3 separate address spaces.
Is there a Win32 API which will setup the LDT and give me the values for the appropriate selectors?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
答案是：是的，但是。
你想要的API实际上在NT内核中，叫做NtSetLdtEntries。它没有标题。没有任何相关文档。存根位于 ntdll.lib 中，它不是 SDK 的一部分。你必须像我一样，在逆向工程站点中摸索并手动绑定东西，直到我能让它工作。
还有更糟糕的。您不能使用 GS，因为 Windows 在内部使用它；每当你进行系统调用时，它都会任意将其设置为 0（我认为它也可能在中断时随机将其设置为 0）。如果您尝试使用 GS 调试程序，Windows 会将断点设置为 0！
ES和FS都不错。我认为。
这是我编写的使用所有这些内容的未记录文件。如果您足够勇敢，您也许能够从中提取足够的信息来做一些有用的事情。祝你好运...
http://lbw.git.sourceforge.net/git/gitweb.cgi?p=lbw/lbw;a=blob;f=src/syscalls/thread.cc;hb=a3b44871bd89009e644894431cbc6534fe033369
The answer is: yes, but.
The API you want is actually in the NT kernel and is called NtSetLdtEntries. There isn't a header for it. There isn't any documentation for it. The stubs are in ntdll.lib, which isn't part of the SDK. You have to do what I did and grope around among reverse engineering sites and manually bind things until I could make it work.
There's worse. You can't use GS, as Windows uses it internally; whenever you make a system call, it'll arbitrarily set it to 0 (and I think it may also randomly set it to 0 on interrupts). If you try to debug a program using GS, Windows will set it to 0 on breakpoints!
ES and FS are fine. I think.
Here is an undocumented file I wrote that uses all this stuff. If you're brave, you may be able to extract enough information from it to do something useful. Good luck...
http://lbw.git.sourceforge.net/git/gitweb.cgi?p=lbw/lbw;a=blob;f=src/syscalls/thread.cc;hb=a3b44871bd89009e644894431cbc6534fe033369