c++ x64 thunk

[shelllet]

msvc x64 编译器，参数入栈信息:

static function

someCallbackMechanism(1, 2, 3, 4, 5, 6);
00007FF7F9E357CA C7 44 24 28 06 00 00 00 mov         dword ptr[rsp + 28h], 6
00007FF7F9E357D2 C7 44 24 20 05 00 00 00 mov         dword ptr[rsp + 20h], 5
00007FF7F9E357DA 41 B9 04 00 00 00    mov         r9d, 4
00007FF7F9E357E0 41 B8 03 00 00 00    mov         r8d, 3
00007FF7F9E357E6 BA 02 00 00 00       mov         edx, 2
00007FF7F9E357EB B9 01 00 00 00       mov         ecx, 1
00007FF7F9E357F0 E8 16 11 FE FF       call        someCallbackMechanism(07FF7F9E1690Bh)

class member function

myClassInstance.simpleCallback6(1, 2, 3, 4, 5, 6);
00007FF77CAC5797 C7 44 24 30 06 00 00 00 mov         dword ptr[rsp + 30h], 6
00007FF77CAC579F C7 44 24 28 05 00 00 00 mov         dword ptr[rsp + 28h], 5
00007FF77CAC57A7 C7 44 24 20 04 00 00 00 mov         dword ptr[rsp + 20h], 4
00007FF77CAC57AF 41 B9 03 00 00 00    mov         r9d, 3
00007FF77CAC57B5 41 B8 02 00 00 00    mov         r8d, 2
00007FF77CAC57BB BA 01 00 00 00       mov         edx, 1
00007FF77CAC57C0 48 8D 4C 24 48       lea         rcx, [myClassInstance]
00007FF77CAC57C5 E8 46 11 FE FF       call        MyClass::simpleCallback6(07FF77CAA6910h)

thunk :
params: 0

 lea rcx, 0x5F840FFC78
 mov rax, 0x5F840FFC78
 jmp rax

params: 1

 mov rdx, rcx
 lea rcx,0x5F840FFC78
 mov rax, 0x5F840FFC78
 jmp rax

params: 2

 mov r8, rdx
 mov rdx, rcx
 mov rcx, 0x5F840FFC78
 mov rax, 0x5F840FFC78
 jmp rax

params: 3

 mov r9, r8
 mov r8, rdx
 mov rdx, rcx
 mov rcx, 0x5F840FFC78 // this
 mov rax, 0x5F840FFC78 // addr
 jmp rax

params: 4

 mov [esp+20], r9d
 mov r9d, r8d
 mov r8d, edx
 mov edx, ecx
 lea rc, [this]
 mov eax, [addr]
 jmp eax

params: 5++

 mov [esp+20 + (x-4)*8], [esp+20]
 mov [esp+20], r9d
 mov r9d, r8d
 mov r8d, edx
 mov edx, ecx
 lea rc, [this]
 mov eax, [addr]
 jmp eax

[shelllet]

x64 Architecture

[shelllet]

相关视频链接：
youtube: https://youtu.be/GMZXkO3AoPg
bilibili:https://www.bilibili.com/video/BV1Rf4y1J77N?share_source=copy_web