___asm替代Windows上的64位 [英] ___asm alternative for 64 bit on windows

问题描述

我们的应用程序是用C ++编写的。在某些地方，我们通过以下代码检查是否有任何调试器附加到应用程序

Hi,

We have our application which is written in C++. At some places we check if any debugger is attached to the application by following code

char IsDbgPresent = 0;
__asm {
mov eax, fs:[30h]
mov al, [eax + 2h]
mov IsDbgPresent, al
}

if(IsDbgPresent)
{
 MessageBox(NULL, TEXT("Debugger Found!"), TEXT("Debugger Found!"), 0);
return true;
ExitProcess(1);
} 

当我尝试为64位版本使用相同的代码时，我发现不再支持__asm 64位。我知道我可以使用IsDebuggerPresent而不是上面的代码。



如果我们可以将上面的代码翻译成C / C ++，有人可以告诉我。



提前谢谢。

When i tried to use the same code for 64 bit version, I found that __asm is no longer supported for 64 bit . I am aware that i can use IsDebuggerPresent instead of above code.

Can anybody let me know if we can translate above code to C/C++.

Thanks in advance.

推荐答案

你是对的。 Microsoft的64位编译器不支持内联汇编程序，并且在您显示的内联汇编程序中没有C或C ++的直接等效项。部分是因为无法通过C / C ++代码间接地处理 FS 寄存器。您可以将MASM与单独的汇编程序源文件一起使用并链接结果。

有一种方法可以解决这个问题，我目前正在研究这个问题，那就是使用Just In Time（JIT）汇编程序来在运行时生成可调用的汇编语言代码。这样的JIT可以在 AsmJit [ ^ ]项目，很快就在 QOR [ ^ ]但是为了1个函数，在你的项目中包含大量的代码。

You''re correct. Inline assembler is not supported by Microsoft''s 64bit compilers and there is no direct equivalent in C or C++ for the inline assembler you show. Partly because there is no way to address the FS register even indirectly from C/C++ code. You can use MASM with a separate assembler source file and link the result.
There is one way to solve this which I am currently working on and that is to use a Just In Time (JIT) assembler to generate callable assembly language code at runtime. Such a JIT is available for free at the AsmJit[^] project and soon within the QOR[^] but it is a large ammount of code to inlclude within your project for the sake of 1 function.

你试过内在因素 [ ^ ]？



这样的事情可以起作用：

Did you try Intrinsics[^]?

Something like this could work:

unsigned long tmp = __readfsdword(0x30);
IsDbgPresent = *((char *)(tmp + 0x2));

我不确定64位代码的偏移是否会改变，我试图搜索但无法找到任何信息。

I''m not sure if the offsets would change for 64 bit code, I tried to search but couldn''t find any info on that.

32 -bit寄存器扩展为''r''寄存器，因此EAX，EBX，ECX，ESP的64位扩展名为RAX，RBX，RCX，RSP等。请参阅：

< a href =http://en.wikipedia.org/wiki/X86-64> http://en.wikipedia.org/wiki/X86-64 [ ^ ]，

http://forum.codecall.net/topic/52853-x86-64-register-chart/ [ ^ ]。

-SA

The 32-bit registers are extended with ''r'' registers, so 64-bit extensions of EAX, EBX, ECX, ESP are named RAX, RBX, RCX, RSP, etc. Please see:
http://en.wikipedia.org/wiki/X86-64[^],
http://forum.codecall.net/topic/52853-x86-64-register-chart/[^].

—SA

这篇关于___asm替代Windows上的64位的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！