一个简单用来生成shellcode的类

前几天在生成shellcode的时候用的硬编码，后来自己写了个类，可以用来接收一些地址什么的动态生成

class SHELLCODE {
public:
	int size;
	int now_point;
	BYTE* shellcode;
	SHELLCODE(int size);
	void append(BYTE payload);
	void append(WORD payload);
	void append(DWORD payload);
	void push(LONG payload);
	void moveax(DWORD payload);
	void jmpeax();
	void jmp_eax_();
	void jmp_address_(DWORD payload);
	void calleax();
	void call_eax_();
	void call_address_(DWORD payload);
	void ret(BYTE payload);
};

size保存的是总的大小,now_point是当前可以填充的下一个指针，复制shellcode时候大小就是now_point
call_eax_代表了 call[eax]
calleax就是 call eax

SHELLCODE::SHELLCODE(int size) {
	this->size = size;
	this->now_point = 0;
	this->shellcode = (BYTE*)malloc(sizeof(BYTE)*size);
}
void SHELLCODE::append(BYTE payload) {
	this->shellcode[now_point] = payload;
	this->now_point++;
}
void SHELLCODE::append(WORD payload) {
	this->append(*((BYTE*)&payload));
	this->append(*((BYTE*)&payload + 1));
}
void SHELLCODE::append(DWORD payload) {
	this->append(*((WORD*)&payload));
	this->append(*((WORD*)&payload + 1));
}
void SHELLCODE::push(LONG payload) {
	if (payload >= -128 && payload <= 127) {
		this->append((BYTE)0x6a);
		this->append((BYTE)payload);
	}
	else {
		this->append((BYTE)0x68);
		this->append((DWORD)payload);
	};
}
void SHELLCODE::moveax(DWORD payload) {
	this->append((BYTE)0xb8);
	this->append(payload);
}
void SHELLCODE::jmpeax() {
	this->append((WORD)0xe0ff);
}
void SHELLCODE::jmp_eax_() {
	this->append((WORD)0x20ff);
}
void SHELLCODE::jmp_address_(DWORD payload) {
	this->append((WORD)0x25ff);
	this->append(payload);
}
void SHELLCODE::calleax() {
	this->append((WORD)0xd0ff);
}
void SHELLCODE::call_eax_() {
	this->append((WORD)0x10ff);
}
void SHELLCODE::call_address_(DWORD payload) {
	this->append((WORD)0x15ff);
	this->append(payload);
}
void SHELLCODE::ret(BYTE payload) {
	this->append((BYTE)0xc2);
	this->append(payload);
	this->append((BYTE)0x00);
}

比如说我们要构造一个messagebox的汇编
简单的使用

SHELLCODE shellcode(100);
shellcode.push(0);
shellcode.push(0);
shellcode.push(0);
shellcode.push(0);
shellcode.moveax(地址)
shellcode.calleax()
shellcode.ret(0x10)