Skip to content

Instantly share code, notes, and snippets.

@DvdGiessen
Created January 10, 2019 23:26
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save DvdGiessen/074e3c83ccbbd15aa37fcebef68d40a3 to your computer and use it in GitHub Desktop.
Save DvdGiessen/074e3c83ccbbd15aa37fcebef68d40a3 to your computer and use it in GitHub Desktop.
Simple process launcher for Windows written in x64 assembly
extrn GetStartupInfoW: PROC
extrn CreateProcessW: PROC
extrn ExitProcess: PROC
.data
target word 2eh, 2eh, 5ch, 42h, 61h, 73h, 65h, 5ch, 42h, 69h, 6eh, 61h, 72h
word 69h, 65h, 73h, 5ch, 57h, 69h, 6eh, 36h, 34h, 53h, 74h, 65h, 61h
word 6dh, 5ch, 43h, 69h, 76h, 69h, 6ch, 69h, 7ah, 61h, 74h, 69h, 6fh
word 6eh, 56h, 49h, 5fh, 44h, 58h, 31h, 32h, 2eh, 65h, 78h, 65h, 0
; ..\Base\Binaries\Win64Steam\CivilizationVI_DX12.exe as UTF-16
.code
main proc frame
local startupInfo [104] :byte
local processInfo [24] :byte
; set up stack base
push rbp
.pushreg rbp
mov rbp, rsp
.setframe rbp, 0
; reserve space on stack for structs + last 6 CreateProcessW arguments + shadow space
sub rsp, 32 + 104 + 24 + 6 * 8 + 32
.allocstack 32 + 104 + 24 + 6 * 8 + 32
.endprolog
; get startupInfo for this process
lea rcx, startupInfo
call GetStartupInfoW
; write arguments for CreateProcessW to reserved space on stack
lea rax, processInfo
mov qword ptr [rsp + 72], rax ; lpProcessInformation
lea rax, startupInfo
mov qword ptr [rsp + 64], rax ; lpStartupInfo
mov qword ptr [rsp + 56], 0 ; lpCurrentDirectory = NULL
mov qword ptr [rsp + 48], 0 ; lpEnvironment = NULL
mov qword ptr [rsp + 40], 0 ; dwCreationFlags = 0
mov qword ptr [rsp + 32], 0 ; bInheritHandles = NULL
; first 4 arguments are passed via registers
mov r9, 0 ; lpThreadAttributes = NULL
mov r8, 0 ; lpProcessAttributes = NULL
mov rdx, 0 ; lpCommandLine = NULL
lea rcx, target ; lpApplicationName = target
; run target process using CreateProcessW
call CreateProcessW
; exit this process
mov rcx, rax ; uExitCode = returncode of CreateProcessW
call ExitProcess ; explicitly exit, see https://stackoverflow.com/a/39907035
; never reached, but if you want to know: this is how we'd properly restore the stack
add rsp, 32 + 104 + 24 + 6 * 8 + 32
pop rbp
ret 0
align 4
main endp
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment