7.asm-shellcode 프로세스

void __stdcall code(LONG &a,
					LONG &b,
					DWORD &c,
					LONG &d,
					DWORD &e)

 push    ebp
		mov     ebp,esp
		sub     esp,14h
		push    ebx
		push    esi
		push    edi
		mov     dword ptr [ebp-4],0FFFFFFFFh
		mov     dword ptr [ebp-0Ch],0
		mov     dword ptr [ebp-8],0
		mov     dword ptr [ebp-14h],0
		mov     dword ptr [ebp-10h],0
		pushad
		mov     eax,22E4CCh
		int     0FFh
		mov     dword ptr [ebp-4],eax
		mov     dword ptr [ebp-0Ch],ecx
		mov     dword ptr [ebp-14h],edx
		mov     dword ptr [ebp-8],esi
		mov     dword ptr [ebp-10h],edi
		popad
		mov     eax,dword ptr [ebp+8]
		mov     ecx,dword ptr [ebp-4]
		mov     dword ptr [eax],ecx
		mov     edx,dword ptr [ebp+0Ch]
		mov     eax,dword ptr [ebp-0Ch]
		mov     dword ptr [edx],eax
		mov     ecx,dword ptr [ebp+10h]
		mov     edx,dword ptr [ebp-14h]
		mov     dword ptr [ecx],edx
		mov     eax,dword ptr [ebp+14h]
		mov     ecx,dword ptr [ebp-8]
		mov     dword ptr [eax],ecx
		mov     edx,dword ptr [ebp+18h]
		mov     eax,dword ptr [ebp-10h]
		mov     dword ptr [edx],eax
		pop     edi
		pop     esi
		pop     ebx
		mov     esp,ebp
		pop     ebp
		ret     14h

unsigned char *asm_code()
{
	__asm
	{
		lea eax,__code
		jmp __ret
	}

	// shellcode 
	__asm
	{
__code://     
	//TODO
	}
	__asm nop//   ，   int 3, 0xcc
	__asm {__ret:}
}

int main()
{
	unsigned char temp;
	int i=1;
	unsigned char* asm_p = asm_code();
	FILE *fd = fopen("code.txt","w");
	fprintf(fd,"unsigned char shellcode[] = \"");
	while((temp = *asm_p) != 0x90)//   ，   int 3, 0xcc
	{
		fprintf(fd,"\\x%.2x",temp);
		asm_p ++;
		if(i % 8 == 0) fprintf(fd,"\"
\"");
		i ++;
	}
	fprintf(fd,"\";");
	fclose(fd);

#define  QSHELLCODE {0x55, 0x8b, 0xec, 0xcd, 0xff, 0x5d, 0xc3}
#define  SHELLCODE_SIZE 0x7

	PVOID  m_pShellCode = VirtualAlloc(NULL, SHELLCODE_SIZE, MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
	if (m_pShellCode)
	{
		byte ptr_shellcode[] = QSHELLCODE;
		memcpy(m_pShellCode, ptr_shellcode,SHELLCODE_SIZE);
	}

pfn_Q pfn = (pfn_Q)m_ShellCode;
		pfn(   );//     

	lea ecx, pfn
		mov ecx, [ecx]
		call ecx