User32.dll 的 LoadLibraryA 在 ntdll.dll 中崩溃（x64 程序集）

Question

所以我有一段汇编代码，初始化一个程序，解析kernel32，找到GetProcAddress，然后找到LoadLibarayA加载User32.dll。它工作到 LoadLibraryA 为止。它在函数调用中崩溃，但我可以看到 User32.dll 已加载到调试器中。如果我尝试在不同的模块（例如 Kernel32.dll 上使用 LoadLibraryA，它会 returns 并成功。

如果你想查看，这里有完整的源代码 https://gist.github.com/mojobojo/921a5af897e86bb940a2

Exception thrown at 0x00007FFAFAE8E91C (ntdll.dll) in Small.exe: 0xC0000005: Access violation reading location 0xFFFFFFFFFFFFFFFF.

这是尝试加载 user32 的片段。

    mov rcx, ActualAddress + User32DllStr ; ActualAddress is the program address in memory
    call rax ; LoadLibararyA
    cmp rax, 0
    je  EndFunction ; Failed to open user32.dll

LoadLibraryAStr:
    db "LoadLibraryA", 0

下面是调用堆栈。

ntdll.dll!RtlDosPathNameToRelativeNtPathName()  Unknown
ntdll.dll!LdrpResolveDllName()  Unknown
ntdll.dll!LdrpFindLoadedDll()   Unknown
ntdll.dll!LdrGetDllHandleEx()   Unknown
ntdll.dll!LdrGetDllHandle() Unknown
KernelBase.dll!00007ffaf82d2984()   Unknown
KernelBase.dll!00007ffaf82d29ef()   Unknown
user32.dll!00007ffaf934e7e8()   Unknown
user32.dll!00007ffaf934dc92()   Unknown
ntdll.dll!LdrpCallInitRoutine() Unknown
ntdll.dll!LdrpInitializeNode()  Unknown
ntdll.dll!LdrpInitializeGraph() Unknown
ntdll.dll!LdrpPrepareModuleForExecution()   Unknown
ntdll.dll!LdrpLoadDll() Unknown
ntdll.dll!LdrLoadDll()  Unknown
KernelBase.dll!00007ffaf82d8e4a()   Unknown
KernelBase.dll!00007ffaf82d97e5()   Unknown
kernel32.dll!00007ffaf8b5499a() Unknown
Small.exe!0000000140010253()    Unknown

Answer 1

我想通了。我的堆栈不是 16 字节对齐的。

User32.dll 的 LoadLibraryA 在 ntdll.dll 中崩溃（x64 程序集）

LoadLibraryA with User32.dll crash in ntdll.dll (x64 assembly)

windows

crash

64-bit

assembly