msf生成弹出calc一段shellcode分析

00446000 | FC               | cld                                   |
00446001 | E8 82000000      | call shellcodeanalyse.446088          |
00446006 | 60               | pushad                                |
00446007 | 89E5             | mov ebp,esp                           | upper stack
00446009 | 31C0             | xor eax,eax                           | eax:unsigned char * buf
0044600B | 64:8B50 30       | mov edx,dword ptr fs:[eax+30]         | PEB
0044600F | 8B52 0C          | mov edx,dword ptr ds:[edx+C]          | DllList
00446012 | 8B52 14          | mov edx,dword ptr ds:[edx+14]         | InMemoryOrderModuleList
00446015 | 8B72 28          | mov esi,dword ptr ds:[edx+28]         | Full_DLLNAME_Buffer
00446018 | 0FB74A 26        | movzx ecx,word ptr ds:[edx+26]        | MaximumLength
0044601C | 31FF             | xor edi,edi                           | edi:___argv
0044601E | AC               | lodsb                                 |
0044601F | 3C 61            | cmp al,61                             | upper(ch)
00446021 | 7C 02            | jl shellcodeanalyse.446025            |
00446023 | 2C 20            | sub al,20                             |
00446025 | C1CF 0D          | ror edi,D                             | (rotate)res>> 0xD
00446028 | 01C7             | add edi,eax                           | edi:___argv, eax:unsigned char * buf
0044602A | E2 F2            | loop shellcodeanalyse.44601E          |
0044602C | 52               | push edx                              | edi:hash of(dll name)
0044602D | 57               | push edi                              | edi:___argv
0044602E | 8B52 10          | mov edx,dword ptr ds:[edx+10]         | dllbase
00446031 | 8B4A 3C          | mov ecx,dword ptr ds:[edx+3C]         | nt_headers
00446034 | 8B4C11 78        | mov ecx,dword ptr ds:[ecx+edx+78]     | export_entry
00446038 | E3 48            | jecxz shellcodeanalyse.446082         | jump if ecx==0 judge if export_table is exist
0044603A | 01D1             | add ecx,edx                           | ecx: export_directory
0044603C | 51               | push ecx                              |
0044603D | 8B59 20          | mov ebx,dword ptr ds:[ecx+20]         |
00446040 | 01D3             | add ebx,edx                           | ebx:address_of_names
00446042 | 8B49 18          | mov ecx,dword ptr ds:[ecx+18]         | ecx:number_of_names
00446045 | E3 3A            | jecxz shellcodeanalyse.446081         | judge if no function export by name
00446047 | 49               | dec ecx                               |
00446048 | 8B348B           | mov esi,dword ptr ds:[ebx+ecx*4]      | function_name table(releative)
0044604B | 01D6             | add esi,edx                           | function_name
0044604D | 31FF             | xor edi,edi                           | edi:___argv
0044604F | AC               | lodsb                                 |
00446050 | C1CF 0D          | ror edi,D                             | edi:___argv
00446053 | 01C7             | add edi,eax                           | edi:___argv, eax:unsigned char * buf
00446055 | 38E0             | cmp al,ah                             |
00446057 | 75 F6            | jne shellcodeanalyse.44604F           |
00446059 | 037D F8          | add edi,dword ptr ss:[ebp-8]          | edi:hash of(func name)+ hash of(dll name)
0044605C | 3B7D 24          | cmp edi,dword ptr ss:[ebp+24]         | if hash_value == target_hash_value
0044605F | 75 E4            | jne shellcodeanalyse.446045           |
00446061 | 58               | pop eax                               | eax:unsigned char * buf
00446062 | 8B58 24          | mov ebx,dword ptr ds:[eax+24]         | eax+24:buf+24
00446065 | 01D3             | add ebx,edx                           | AddressOfNameOrdinals base
00446067 | 66:8B0C4B        | mov cx,word ptr ds:[ebx+ecx*2]        | index of function in table
0044606B | 8B58 1C          | mov ebx,dword ptr ds:[eax+1C]         | eax+1C:buf+1C
0044606E | 01D3             | add ebx,edx                           | Addres
00446070 | 8B048B           | mov eax,dword ptr ds:[ebx+ecx*4]      | eax:unsigned char * buf
00446073 | 01D0             | add eax,edx                           | RealFunctionAddress
00446075 | 894424 24        | mov dword ptr ss:[esp+24],eax         | [esp+24]:__acrt_InitializeCriticalSectionEx+5C, eax:unsigned char * buf
00446079 | 5B               | pop ebx                               |
0044607A | 5B               | pop ebx                               |
0044607B | 61               | popad                                 |
0044607C | 59               | pop ecx                               |
0044607D | 5A               | pop edx                               | edx:_Tlg_Microsoft_CRTProviderProv
0044607E | 51               | push ecx                              | return_address
0044607F | FFE0             | jmp eax                               | eax:unsigned char * buf
00446081 | 5F               | pop edi                               | edi:___argv
00446082 | 5F               | pop edi                               | edi:___argv
00446083 | 5A               | pop edx                               | edx:_Tlg_Microsoft_CRTProviderProv
00446084 | 8B12             | mov edx,dword ptr ds:[edx]            | edx:_Tlg_Microsoft_CRTProviderProv
00446086 | EB 8D            | jmp shellcodeanalyse.446015           |
00446088 | 5D               | pop ebp                               |
00446089 | 6A 01            | push 1                                | ShowNormal
0044608B | 8D85 B2000000    | lea eax,dword ptr ss:[ebp+B2]         | eax:unsigned char * buf
00446091 | 50               | push eax                              | str[calc.exe]
00446092 | 68 318B6F87      | push 876F8B31                         | (WinExec hash_value)+(kernel32 hash_value)
00446097 | FFD5             | call ebp                              | WinExec
00446099 | BB F0B5A256      | mov ebx,56A2B5F0                      | (ExitProcess hash_value)+(kernel32 hash_value)
0044609E | 68 A695BD9D      | push 9DBD95A6                         | (GetVersion hash_value)+(kernel32 hash_value)
004460A3 | FFD5             | call ebp                              | GetVersion
004460A5 | 3C 06            | cmp al,6                              |
004460A7 | 7C 0A            | jl shellcodeanalyse.4460B3            | if(GetVersion()<6)
004460A9 | 80FB E0          | cmp bl,E0                             |
004460AC | 75 05            | jne shellcodeanalyse.4460B3           |
004460AE | BB 4713726F      | mov ebx,6F721347                      | OldVersion's(ExitProcess hash_value)
004460B3 | 6A 00            | push 0                                |
004460B5 | 53               | push ebx                              |
004460B6 | FFD5             | call ebp                              | ExitProcess
004460B8 | 63               | ascii c                               |
004460B9 | 61               | ascii a                               |
004460BA | 6C               | ascii l                               |
004460BB | 63               | ascii c                               |
004460BC | 2E               | ascii .                               |
004460BD | 65               | ascii e                               |
004460BE | 78               | ascii x                               |
004460BF | 65               | ascii e                               |
004460C0 | 00               | ascii \0                              |
004460C1 | 00               | ascii \0                              |

原shellcode：

unsigned char buf[] =
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
"\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00\x00\x50\x68\x31\x8b\x6f"
"\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5"
"\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a"
"\x00\x53\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";