本人新人，但是关注看雪前辈、大牛们的文章很久了，确实受益匪浅~最近一段时间对windows x64 shellcode比较感兴趣，发现看雪里有一些很好的文章，同时从互联网上看到几个页面，写了这方面，很好：1、http://www.cdut-boy.com/tag/shellcode/ 2、http://mcdermottcybersecurity.com/articles/windows-x64-shellcode，其中第二篇写得更棒，Bill McDermott写的，崇拜and敬仰~
    于是，拿他的代码去机器上调试，结果测出了一点问题，具体如下：
    他说，

 
    lea rdx, loadlib_func
    lea rcx, kernel32_dll
    call lookup_api         ;get address of LoadLibraryA
    mov r15, rax            ;save for later use with forwarded exports
 
    lea rcx, user32_dll
    call rax                ;load user32.dll
 
    lea rdx, msgbox_func
    lea rcx, user32_dll
    call lookup_api         ;get address of MessageBoxA
 
    xor r9, r9              ;MB_OK
    lea r8, title_str       ;caption
    lea rdx, hello_str      ;Hello world
    xor rcx, rcx            ;hWnd (NULL)
    call rax                ;display message box

    kernel32_dll    db  'KERNEL32.DLL', 0
    loadlib_func    db  'LoadLibraryA', 0
    user32_dll      db  'USER32.DLL', 0
    msgbox_func     db  'MessageBoxA', 0
    hello_str       db  'Hello world', 0
    title_str       db  'Message', 0

        Lea rdx, str_loadlib_func
	Lea rcx, str_kernel32_dll
	Call lookup_api         ;get address of LoadLibraryA,rax=LoadLibraryA
	Mov r15, rax

	Lea rdx, str_create_thread
	Lea rcx, str_kernel32_dll
	Call lookup_api         ;get address of createthread to rax

        str_kernel32_dll: DB 'KERNEL32.DLL', 0H
        str_loadlib_func: DB 'LoadLibraryA', 0H
        str_create_thread: DB 'CreateThread', 0H

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！