:laugh: :laugh: :laugh:
This trick will show you how shellcode works (in a simple way).
First, create a Win32 application, and delete all generated code in your
main.cpp and leave the
_tWinMain
block empty and return 0. And then, put
MessageBox
function, make all parameters zero. The code in
main.cpp should be like this:
int APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int nCmdShow)
{
MessageBox(0,0,0,0);
int a = 0;
return 0;
}
Set breakpoint at
int a = 0
, build, and debug. The program will stop at the breakpoint, and show disassembly. the disassembly showing these codes:
int APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int nCmdShow)
{
004113B0 55 push ebp
004113B1 8B EC mov ebp,esp
004113B3 81 EC CC 00 00 00 sub esp,0CCh
004113B9 53 push ebx
004113BA 56 push esi
004113BB 57 push edi
004113BC 8D BD 34 FF FF FF lea edi,[ebp-0CCh]
004113C2 B9 33 00 00 00 mov ecx,33h
004113C7 B8 CC CC CC CC mov eax,0CCCCCCCCh
004113CC F3 AB rep stos dword ptr es:[edi]
MessageBox(0,0,0,0)
004113CE 8B F4 mov esi,esp
004113D0 6A 00 push 0
004113D2 6A 00 push 0
004113D4 6A 00 push 0
004113D6 6A 00 push 0
004113D8 FF 15 40 83 41 00 call dword ptr [__imp__MessageBoxW@16 (418340h)]
004113DE 3B F4 cmp esi,esp
004113E0 E8 5B FD FF FF call @ILT+315(__RTC_CheckEsp) (411140h)
int a = 0
004113E5 C7 45 F8 00 00 00 00 mov dword ptr [a],0
return 0
004113EC 33 C0 xor eax,eax
}
copy and paste these lines to a text editor:
004113CE 8B F4 mov esi,esp
004113D0 6A 00 push 0
004113D2 6A 00 push 0
004113D4 6A 00 push 0
004113D6 6A 00 push 0
004113D8 FF 15 40 83 41 00 call dword ptr [__imp__MessageBoxW@16
and get the hex values (8B F4 6A 00 ... until FF 15 40 83 41 00), and convert it to string. The result would be like this:
char* shellcode ="\x8B\xF4\x6A\x00\x6A\x00\x6A\x00\x6A\x00\xFF\x15\x40\x83\x41\x00";
Back to
main.cpp, declare a pointer to function, delete the
MessageBox
function and the dummy variable. And here is the final code:
int APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int nCmdShow)
{
typedef void (* FUNC_PTR)();
char* shellcode ="\x8B\xF4\x6A\x00\x6A\x00\x6A\x00\x6A\x00\xFF\x15\x40\x83\x41\x00";
FUNC_PTR p = (FUNC_PTR)shellcode;
p();
return 0;
}
Build and run the program, and it will show a message box (plus an unhandled exception message) ;P .