shellcode就是汇编的opcode，一般以子函数形式出现：
取得shellcode的方便方式是：
1.写一个函数如：
void __stdcall code(LONG &a,
LONG &b,
DWORD &c,
LONG &d,
DWORD &e)
取得它的汇编码：如：
push ebp
mov ebp,esp
sub esp,14h
push ebx
push esi
push edi
mov dword ptr [ebp-4],0FFFFFFFFh
mov dword ptr [ebp-0Ch],0
mov dword ptr [ebp-8],0
mov dword ptr [ebp-14h],0
mov dword ptr [ebp-10h],0
pushad
mov eax,22E4CCh
int 0FFh
mov dword ptr [ebp-4],eax
mov dword ptr [ebp-0Ch],ecx
mov dword ptr [ebp-14h],edx
mov dword ptr [ebp-8],esi
mov dword ptr [ebp-10h],edi
popad
mov eax,dword ptr [ebp+8]
mov ecx,dword ptr [ebp-4]
mov dword ptr [eax],ecx
mov edx,dword ptr [ebp+0Ch]
mov eax,dword ptr [ebp-0Ch]
mov dword ptr [edx],eax
mov ecx,dword ptr [ebp+10h]
mov edx,dword ptr [ebp-14h]
mov dword ptr [ecx],edx
mov eax,dword ptr [ebp+14h]
mov ecx,dword ptr [ebp-8]
mov dword ptr [eax],ecx
mov edx,dword ptr [ebp+18h]
mov eax,dword ptr [ebp-10h]
mov dword ptr [edx],eax
pop edi
pop esi
pop ebx
mov esp,ebp
pop ebp
ret 14h
转换成机器码：
unsigned char *asm_code()
{
__asm
{
lea eax,__code
jmp __ret
} // shellcode
__asm
{
__code://要加的汇编
//TODO
}
__asm nop//标志位，一般是int 3,即0xcc
__asm {__ret:}
}
int main()
{
unsigned char temp;
int i=1;
unsigned char* asm_p = asm_code();
FILE *fd = fopen("code.txt","w");
fprintf(fd,"unsigned char shellcode[] = \"");
while((temp = *asm_p) != 0x90)//标志位，一般是int 3,即0xcc
{
fprintf(fd,"\\x%.2x",temp);
asm_p ++;
if(i % 8 == 0) fprintf(fd,"\"\n\"");
i ++;
}
fprintf(fd,"\";");
fclose(fd);
运行得到shellcode[]数组在code.txt中，取出
调用方式一般采用：
#define QSHELLCODE {0x55, 0x8b, 0xec, 0xcd, 0xff, 0x5d, 0xc3}
#define SHELLCODE_SIZE 0x7
PVOID m_pShellCode = VirtualAlloc(NULL, SHELLCODE_SIZE, MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if (m_pShellCode)
{
byte ptr_shellcode[] = QSHELLCODE;
memcpy(m_pShellCode, ptr_shellcode,SHELLCODE_SIZE);
}
最后调用有两种方式，一种是：
pfn_Q pfn = (pfn_Q)m_ShellCode;
pfn(填参数);//函数直接调
另一种是汇编:
lea ecx, pfn
mov ecx, [ecx]
call ecx
当然，有参数就先push参数