简体   繁体   中英

Convert AT&T syntax to Intel Syntax (ASM)

I've been trying to access the peb information of an executable as seen here: Access x64 TEB C++ & Assembly

The code works only in AT&T syntax for some odd reason but when I try to use Intel syntax, it fails to give the same value. There's of course an error on my part. So I'm asking..

How can I convert:

int main()
{
    void* ptr = 0; //0x7fff5c4ff3c0
    asm volatile
    (
        "movq %%gs:0x30, %%rax\n\t"
        "movq 0x60(%%rax), %%rax\n\t"
        "movq 0x18(%%rax), %%rax\n\t"
        "movq %%rax, %0\n"
        : "=r" (ptr) ::
    );
}

to Intel Syntax?

I tried:

asm volatile
(
    "movq rax, gs:[0x30]\n\t"
    "movq rax, [rax + 0x60]\n\t"
    "movq rax, [rax + 0x18]\n\t"
    "movq rax, %0\n"
    : "=r" (ptr) ::
);

and:

asm volatile
(
    "mov rax, QWORD PTR gs:[0x30]\n\t"
    "mov rax, QWORD PTR [rax + 0x60]\n\t"
    "mov rax, QWORD PTR [rax + 0x18]\n\t"
    "movq rax, %0\n"                     //mov rax, QWORD PTR [%0]\n
    : "=r" (ptr) ::
);

They do not print the same value as the AT&T syntax: 0x7fff5c4ff3c0

Any ideas?

You forgot to reverse operand order on the last line. That said, the only instruction you need to have in asm is the first one due to the gs segment override, the rest could be done in C.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM