具体过程:

一 用visual studio2022新建一个x86汇编项目

二 在x86汇编程序中使用头文件

1.添加头文件，例如entry.inc

entry.inc

1
2
3
4
5
6
7
8
9
10
11
12
;entry.inc
.586
.model flat,stdcall
option casemap:none

includelib ucrt.lib
includelib User32.lib
includelib kernel32.lib
includelib legacy_stdio_definitions.lib

ExitProcess proto dwCode:dword

备注：

汇编头文件后缀名为.inc

删除默认代码，因为会报错

声明放在头文件里面

源文件里面使用include包含头文件,例:include entry.inc

2. 修改entry.asm文件

entry.asm

1
2
3
4
5
6
7
8
9
;entry.asm
include entry.inc

.code
main proc
	push 0
	call ExitProcess
main endp
end

三 invoke指令的使用

使用invoke指令可以方便调用win32 api

entry.asm

1
2
3
4
5
6
7
8
9
10
;entry.asm
include entry.inc

.code
main proc
	;push 0
	;call ExitProcess
	invoke ExitProcess,0
main endp
end

四.导入写好的头文件

1. 下载masm，提取include文件夹

2.在项目中导入所需头文件

3.代码示例

entry.inc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
;entry.inc
.586
.model flat,stdcall
option casemap:none

include include/windows.inc
include include/User32.inc
include include/Kernel32.inc
includelib ucrt.lib
includelib User32.lib
includelib kernel32.lib
includelib legacy_stdio_definitions.lib

.data
Format db "how you doing"

entry.asm

1
2
3
4
5
6
7
8
9
;entry.asm
include entry.inc

.code
main proc
	invoke MessageBoxA,NULL,offset Format,offset Format,MB_OK
	invoke ExitProcess,0
main endp
end

五.无参宏与有参宏

entry.inc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
;entry.inc
.586
.model flat,stdcall
option casemap:none

include include/windows.inc
include include/User32.inc
include include/Kernel32.inc
includelib ucrt.lib
includelib User32.lib
includelib kernel32.lib
includelib legacy_stdio_definitions.lib

RKVIR EQU 12				;无参宏？？？
;有参宏，类似函数
MyAdd MACRO n1				;MACRO声明有参宏，n1:给的一个参数
	add eax,n1
endm						;有参宏结束
.data
Format db "how you doing"

entry.asm

1
2
3
4
5
6
7
8
9
10
11
;entry.asm
include entry.inc

.code
main proc
	mov eax,RKVIR
	MyAdd <1>
	invoke MessageBoxA,NULL,offset Format,offset Format,MB_OK
	invoke ExitProcess,0
main endp
end

六.用invoke调用封装的printf函数

entry.asm

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
;entry.asm
include entry.inc

.code
addx proc numA:dword,numB:dword
	xor  eax,eax
	add eax,numA
	add eax,numB
	ret
addx endp

printfString proc format:dword,var:dword
	mov eax,var
	push eax
	mov eax,format
	push eax
	call printf
	add esp,8
	ret
printfString endp
main proc
	invoke printfString,offset FormatString,offset Format
	invoke addx,10,20
	mov eax,RKVIR
	MyAdd <1>
	invoke MessageBoxA,NULL,offset Format,offset Format,MB_OK
	invoke ExitProcess,0
main endp
end

entry.inc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
;entry.inc
.586
.model flat,stdcall
option casemap:none

include include/windows.inc
include include/User32.inc
include include/Kernel32.inc
includelib ucrt.lib
includelib User32.lib
includelib kernel32.lib
includelib legacy_stdio_definitions.lib

extern printf:proc

RKVIR EQU 12				;无参宏？？？
;有参宏，类似函数
MyAdd MACRO n1				;MACRO声明有参宏，n1:给的一个参数
	add eax,n1
endm						;有参宏结束

.data
Format db "how you doing"
FormatString db "what's up"

七 结构体的使用方法

entry.asm

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
;entry.asm
include entry.inc

.code
addx proc numA:dword,numB:dword
	xor  eax,eax
	add eax,numA
	add eax,numB
	ret
addx endp

printfString proc format:dword,var:dword
	mov eax,var
	push eax
	mov eax,format
	push eax
	call printf
	add esp,8
	ret
printfString endp

main proc
	mov MyPoint.x,123
	mov MyPoint.y,456
	invoke printfString,offset FormatString,offset Format
	invoke addx,10,20
	mov eax,RKVIR
	MyAdd <1>
	invoke MessageBoxA,NULL,offset Format,offset Format,MB_OK
	invoke ExitProcess,0
main endp
end

entry.inc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
;entry.inc
.586
.model flat,stdcall
option casemap:none

include include/windows.inc
include include/User32.inc
include include/Kernel32.inc
includelib ucrt.lib
includelib User32.lib
includelib kernel32.lib
includelib legacy_stdio_definitions.lib

extern printf:proc

RKVIR EQU 12				;无参宏？？？

Point struct
	x word ?
	y word ?
Point ends

;有参宏，类似函数
MyAdd MACRO n1				;MACRO声明有参宏，n1:给的一个参数
	add eax,n1
endm						;有参宏结束

.data
Format db "how you doing"
FormatString db "what's up"
MyPoint Point<?>

八 api中使用结构体

entry.inc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
;entry.inc
.586
.model flat,stdcall
option casemap:none

include include/windows.inc
include include/User32.inc
include include/Kernel32.inc
includelib ucrt.lib
includelib User32.lib
includelib kernel32.lib
includelib legacy_stdio_definitions.lib

extern printf:proc

RKVIR EQU 12				;无参宏？？？

Point struct
	x word ?
	y word ?
Point ends

;有参宏，类似函数
MyAdd MACRO n1				;MACRO声明有参宏，n1:给的一个参数
	add eax,n1
endm						;有参宏结束

.data
Format db "how you doing"
FormatString db "what's up"
MyPoint Point<?>
FilePtah db"C:\\Windows\\System32\\cmd.exe"
StartInfo STARTUPINFO <?>
ProcessInfo PROCESS_INFORMATION <?>

entry.asm

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
;entry.asm
include entry.inc

.code
addx proc numA:dword,numB:dword
	xor  eax,eax
	add eax,numA
	add eax,numB
	ret
addx endp

printfString proc format:dword,var:dword
	mov eax,var
	push eax
	mov eax,format
	push eax
	call printf
	add esp,8
	ret
printfString endp

main proc
	invoke GetStartupInfo,addr StartInfo
	invoke CreateProcess,ADDR FilePtah,NULL,NULL,NULL,NULL,NORMAL_PRIORITY_CLASS,NULL,NULL,addr StartInfo,addr ProcessInfo
	mov MyPoint.x,123
	mov MyPoint.y,456
	invoke printfString,offset FormatString,offset Format
	invoke addx,10,20
	mov eax,RKVIR
	MyAdd <1>
	invoke MessageBoxA,NULL,offset Format,offset Format,MB_OK
	invoke ExitProcess,0
main endp
end