[C++] 纯文本查看 复制代码#include "windows.h"
/* 特征码搜索 */
union MyUnion
{
CHAR code2[4];
int code;
};
int main()
{
/* 读入到内存 */
DWORD dwFileSize = 文件_获取文件大小(TEXT("c:\\C.exe"));
if (INVALID_FILE_SIZE == dwFileSize) { cout << "获取文件大小失败"; return 0; }
/* 分配大小并读入 */
wstring strpath = 文件_取程序执行目录() + wstring(TEXT("\\c.exe"));
CHAR *pFilrBuff = new char[dwFileSize];
文件_读入文件((WCHAR*)strpath.data(), pFilrBuff);
/* 特征码定位 */
CHAR *startCode = pFilrBuff + 0x1002;
CHAR *endCode;
/* 结尾需要搜索下 */
/*此处代表结尾
.text:00401003 59 pop ecx
.text:00401004 5B pop ebx
.text:00401005 58 pop eax
.text:00401006 C3 retn
*/
MyUnion code;
code.code2[0] = 0x59;
code.code2[1] = 0x5b;
code.code2[2] = 0x58;
code.code2[3] = 0xc3;
for (int n = 0; n <= 1000;n++)//搜索1000次找不到就算了
{
if (*((int*)(startCode + n)) == code.code)//找到
{
endCode = (startCode + n);
break;
}
}
/* 找到后输出两指针中间的数据即为机器码 */
/* 例如 startCode此时指向51那个地方 endCode指向59
.text:00401000 50 push eax
.text:00401001 53 push ebx
.text:00401002 51 push ecx
.text:00401003 B8 01 00 00 00 mov eax, 1
.text:00401008 BB 02 00 00 00 mov ebx, 2
.text:0040100D 59 pop ecx
.text:0040100E 5B pop ebx
.text:0040100F 58 pop eax
.text:00401010 C3 retn
*///输出机器码
cout << "The shellcode is:";
while (++startCode != endCode)
{
cout << hex << (int)((unsigned char)*startCode)<
}
/* 删除 */
delete []pFilrBuff;
MessageBoxA(NULL, "生成完毕!", NULL, MB_OK);
return 0;
}