push eax 与 sub esp,0x4的问题

[yhwz_8882]

源码

#include <windows.h>

int main()
{

  __asm
  {
    push ebp
      mov ebp,esp
      xor eax,eax
      //push eax
      //push eax
      //push eax
      sub esp,0xc
      
      mov byte ptr[ebp-0Ch],4Dh
      mov byte ptr[ebp-0Bh],53h
      mov byte ptr[ebp-0Ah],56h
      mov byte ptr[ebp-09h],43h
      mov byte ptr[ebp-08h],52h
      mov byte ptr[ebp-07h],54h
      mov byte ptr[ebp-06h],2Eh
      mov byte ptr[ebp-05h],44h
      mov byte ptr[ebp-04h],4Ch
      mov byte ptr[ebp-03h],4Ch
      lea eax,[ebp-0Ch]
      push eax
      mov edx,0x77E1850D //LoadLibrary sp3
      call edx
      //call ds:LoadLibraryA
      //然后是开一个dos窗口：
      push ebp 
      mov ebp, esp 
      sub esp, 0x2C 
      mov eax, 0x6D6D6F63 
      mov dword ptr [ebp-0x0C], eax
      mov eax, 0x2E646E61 
      mov dword ptr [ebp-0x8], eax
      mov eax, 0x226D6F63 
      mov dword ptr [ebp-0x4], eax
      xor edx, edx 
      mov byte ptr [ebp-0x1], dl 
      lea eax, dword ptr [ebp-0xC]
      push eax 
      mov eax, 0x77b88c10 //system  sp3
      call eax

  }

  

  return 0;
}

在这个里面有这么一段

      push eax
      push eax
      push eax
      mov byte ptr[ebp-0Ch],4Dh
      mov byte ptr[ebp-0Bh],53h
      mov byte ptr[ebp-0Ah],56h
      mov byte ptr[ebp-09h],43h
      mov byte ptr[ebp-08h],52h
      mov byte ptr[ebp-07h],54h
      mov byte ptr[ebp-06h],2Eh
      mov byte ptr[ebp-05h],44h
      mov byte ptr[ebp-04h],4Ch
      mov byte ptr[ebp-03h],4Ch

如果修改成

      sub esp,0xc
      mov byte ptr[ebp-0Ch],4Dh
      mov byte ptr[ebp-0Bh],53h
      mov byte ptr[ebp-0Ah],56h
      mov byte ptr[ebp-09h],43h
      mov byte ptr[ebp-08h],52h
      mov byte ptr[ebp-07h],54h
      mov byte ptr[ebp-06h],2Eh
      mov byte ptr[ebp-05h],44h
      mov byte ptr[ebp-04h],4Ch
      mov byte ptr[ebp-03h],4Ch

就会报一个内存不能read的错误。[我的机器是windows 2003 sp2]
push eax相当于esp-4应该没错吧,为什么就不行了呢？这同样都是在堆栈里开了12个字节的空间啊……

[VincentSailing]

push eax会自动的在后面添加一个结束符0x0，但是如果是利用sub进行划分堆栈空间的话，必须在末尾加上0x0作为结束符