您可以用CreateProcessA
啓動程序並等待WaitForSingleObject
結束。 GCC連接器(LD)還需要一個帶有被推入的字節數的後綴(例如「@ 4」,一個dword =四個字節)。這是使用另一個鏈接器的原因之一。
這裏有一個簡單的例子,以一個 「目錄」 啓動一個shell(CMD.EXE) - 命令:
exec_dir.asm:
STRUC _STARTUPINFO ; https://msdn.microsoft.com/library/windows/desktop/ms686331.aspx
.cb: resd 1
.lpReserved: resd 1
.lpDesktop: resd 1
.lpTitle: resd 1
.dwX: resd 1
.dwY: resd 1
.dwXSize: resd 1
.dwYSize: resd 1
.dwXCountChars: resd 1
.dwYCountChars: resd 1
.dwFillAttribute: resd 1
.dwFlags: resd 1
.wShowWindow: resw 1
.cbReserved2: resw 1
.lpReserved2: resd 1
.hStdInput: resd 1
.hStdOutput: resd 1
.hStdError: resd 1
ENDSTRUC
STRUC _PROCESS_INFORMATION ; https://msdn.microsoft.com/library/windows/desktop/ms684873.aspx
.hProcess: resd 1
.hThread: resd 1
.dwProcessId: resd 1
.dwThreadId: resd 1
ENDSTRUC
section .data
startupinfo:
istruc _STARTUPINFO
iend
procinfo:
istruc _PROCESS_INFORMATION
iend
app_fullpath: db "C:\Windows\System32\cmd.exe",0
params: db "/c dir", 0
msg: db `\n\nok.\n`,0
global _main
EXTERN [email protected], [email protected],[email protected]
EXTERN _puts, _fflush
section .text
_main:
; CreateProcess(app_fullpath,params,0,0,false,0,0,0,&startupinfo,&procinfo)
push procinfo
push startupinfo
push 0
push 0
push 0
push 0
push 0
push 0
push params
push app_fullpath
call [email protected] ; https://msdn.microsoft.com/library/windows/desktop/ms682425.aspx
; WaitForSingleObject(procinfo.hProcess, INFINITE);
push -1 ; INFINITE
push dword [procinfo + _PROCESS_INFORMATION.hProcess]
call [email protected]
; puts ("ok."), fflush to flush the stdout-buffer
push msg
call _puts
mov dword [esp], 0
call _fflush
add esp, 4
; return 0
push 0
call [email protected]
在(Windows)中的命令提示符:
PATH C:\MinGW\bin;<Path\to\nasm.exe>
nasm.exe -fwin32 exec_dir.asm
gcc.exe -m32 -o exec_dir.exe exec_dir.obj
exec_dir.exe
如果你使用Win32 API,開始與['ShellExecuteEx']可執行文件(https://msdn.microsoft.com/en-us/library/windows/desktop/bb762154(v = VS .85).aspx)並等待它以完成['MsgWaitForMultipleObjects'](https://msdn.microsoft.com/en-us/library/windows/desktop/ms684242%28v=vs.85%29.aspx)。或者,如果你正在鏈接'libc' /'msvcrt',你可以使用'system()'函數。 – Michael 2015-03-25 08:24:45