d内存中映射指令并执行

​​原文​​ 

// mov rdx, <wordLen>
  *cast(char*)(code + 14) = 0x48;
  *cast(char*)(code + 15) = 0xC7;
  *cast(char*)(code + 16) = 0xC2;
  *cast(char*)(code + 17) = 12;
  *cast(char*)(code + 18) = 0x00;
  *cast(char*)(code + 19) = 0x00;
  *cast(char*)(code + 20) = 0x00;

  // mov rdx, <分配位置>
  *cast(char*)(code + 21) = 0x48;
  *cast(char*)(code + 22) = 0xC7;
  *cast(char*)(code + 23) = 0xC1;
  *cast(long*)(code + 24) = cast(long)data;
  *cast(char*)(code + 32) = 0x00;

指令是错的,给​​RDX​​​写了两次,用​​mov sign_extend imm32, reg64​​​替换​​mov imm64, reg64 (0x48 0xBA?)​​​.
​​​*cast(char*)(code + 32) = 0x00;​​​附加​​0​​​是什么意思.
答案:

import core.stdc.stdio;
import core.stdc.string;
import core.stdc.stdlib;
import core.sys.posix.sys.mman;

void putbytes(char **code, const char *bytes) {
  uint bt;
  for (int i = 0, n; sscanf(bytes + i, "%x%n", &bt, &n) == 1; i += n)
    { *(*code)++ = cast(char)bt; }
}

void putdata(char **code, char** data) {
  memcpy(*code, data, (*data).sizeof);
  *code += (*data).sizeof;
}

extern (C) void main() {
  char *data = cast(char*)mmap(null, cast(ulong)15, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
  strcpy(data, "你好,世界");

  char *code = cast(char*)mmap(null, cast(ulong)500, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0);
  char *pos = code;

  // 调用写,并退出系统调用
  putbytes(&pos, "48 C7 C0 1 0 0 0");    // mov rax, 0x01     (写syscall)
  putbytes(&pos, "48 C7 C7 1 0 0 0");    // mov rdi, 0x01     (stdout)
  putbytes(&pos, "48 C7 C2 D 0 0 0");   // mov rdx, 13       (串长)
  putbytes(&pos, "48 BE");                      // movabs rsi, data  (串地址)
  putdata(&pos, &data);
  putbytes(&pos, "0F 05");                        // syscall
  putbytes(&pos, "48 C7 C0 3C 0 0 0");  // mov rax, 0x3C     (exit syscall)
  putbytes(&pos, "0F 05");                       // syscall

  // 执行代码.
  (cast(void* function())code)();
}