原程序,调用windows计算器:
#include <windows.h>
int main()
{
WinExec("calc.exe",SW_SHOW);
return 0;
}
用内联汇编代码的方式实现WinExec("calc.exe",SW_SHOW)的功能:
#include <windows.h>
int main()
{
__asm{
push ebp
mov ebp,esp
add esp,-12
mov dword ptr [ebp-4],0
mov byte ptr [ebp-5],0x65
mov byte ptr [ebp-6],0x78
mov byte ptr [ebp-7],0x65
mov byte ptr [ebp-8],0x2e
mov byte ptr [ebp-9],0x63
mov byte ptr [ebp-10],0x6c
mov byte ptr [ebp-11],0x61
mov byte ptr [ebp-12],0x63
push 5
lea eax,dword ptr [ebp-12]
push eax
mov eax,0x76542ec9
call eax
mov esp,ebp
pop ebp
}
return 0;
}
把汇编代码对应的机器码定义到shellcode变量,然后在main函数中用汇编代码进行调用:
#include <windows.h>
char shellcode[] =
"\x55\x8b\xec\x83\xc4\xf4\xc7\x45"
"\xfc\x00\x00\x00\x00\xc6\x45\xfb"
"\x65\xc6\x45\xfa\x78\xc6\x45\xf9"
"\x65\xc6\x45\xf8\x2e\xc6\x45\xf7"
"\x63\xc6\x45\xf6\x6c\xc6\x45\xf5"
"\x61\xc6\x45\xf4\x63\x6a\x05\x8d"
"\x45\xf4\x50\xb8\xc9\x2e\x54\x76"
"\xff\xd0\x8b\xe5\x5d\xc3"; //0x76542ec9是WinExec函数的地址,可能会变。。。
int main()
{
__asm{
lea eax,shellcode
call eax
}
return 0;
}