Skip to content

Commit 8019227

Browse files
NoviceLiveNoviceLive
committed
Added user32!MessageBoxA All Windows x86.
1 parent 69227ee commit 8019227

5 files changed

Lines changed: 219 additions & 0 deletions

File tree

‎windows/messagebox/build32.cmd‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ml /c /coff messagebox32.asm && link /subsystem:windows messagebox32.obj

‎windows/messagebox/messagebox32.asm‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
;;
2+
;; Copyright 2015 Gu Zhengxiong <rectigu@gmail.com>
3+
;;
4+
;; For those curious heads
5+
;; striving to figure out what's under the hood.
6+
;;
7+
;; GPL
8+
;;
9+
10+
11+
.model flat, stdcall
12+
13+
option casemap:none
14+
assume fs:nothing
15+
16+
.code
17+
18+
start:
19+
;; ecx = NtCurrentTeb()->ProcessEnvironmentBlock;
20+
xor ecx, ecx
21+
mov ecx, dword ptr fs:[ecx + 30h]
22+
23+
;; ecx = ecx->Ldr;
24+
mov ecx, dword ptr [ecx + 0ch]
25+
26+
;; ecx = ecx->InInitializationOrderModuleList;
27+
mov ecx, dword ptr [ecx + 1ch]
28+
29+
30+
find_kernel32_dll_base:
31+
;; ebx = ecx->DllBase;
32+
mov ebx, dword ptr [ecx + 8h]
33+
34+
;; eax = ecx->BaseDllName.Buffer;
35+
mov eax, dword ptr [ecx + 20h]
36+
37+
;; ecx = ecx->InInitializationOrderLinks;
38+
mov ecx, dword ptr [ecx]
39+
40+
;; if (eax[6] == '3')
41+
cmp byte ptr [eax + 0ch], 33h
42+
jne find_kernel32_dll_base
43+
44+
45+
;; nonvolatile ebx = LoadLibrary("kernel32.dll");
46+
47+
48+
mov ebp, ebx
49+
;; ebp = ebx->e_lfanew;
50+
add ebp, dword ptr [ebp + 3ch]
51+
;; ebp = ebp->OptionalHeader.DataDirectory[0].VirtualAddress;
52+
mov ebp, dword ptr [ebp + 78h]
53+
add ebp, ebx
54+
55+
56+
;; nonvolatile ebp = IMAGE_EXPORT_DIRECTORY;
57+
58+
59+
;; eax = ebp->AddressOfNames;
60+
mov eax, dword ptr [ebp + 20h]
61+
add eax, ebx
62+
63+
64+
xor edx, edx
65+
find_get_proc_address:
66+
;; esi = eax[edx]; // eax is ExportNamePointerTable, a dword array
67+
mov esi, dword ptr [eax + edx * 4]
68+
add esi, ebx
69+
70+
inc edx
71+
72+
;; if (memcmp(esi, 'PteG', 4))
73+
cmp dword ptr [esi], 'PteG'
74+
jne find_get_proc_address
75+
76+
;; if (memcmp(esi + 4, 'Acor', 4))
77+
cmp dword ptr [esi + 4], 'Acor'
78+
jne find_get_proc_address
79+
80+
81+
;; esi = ebp->AddressOfNameOrdinals;
82+
mov esi, dword ptr [ebp + 24h]
83+
add esi, ebx
84+
85+
;; dx = esi[edx]; // esi is ExportOrdinalTable, a _word_ array
86+
mov dx, word ptr [esi + edx * 2]
87+
88+
;; esi = ebp->AddressOfFunctions;
89+
mov esi, dword ptr [ebp + 1ch]
90+
add esi, ebx
91+
92+
;; esi = esi[edx]; // esi is is ExportAddressTable, a dword array
93+
mov esi, dword ptr [esi + edx * 4 - 4]
94+
add esi, ebx
95+
96+
97+
;; nonvolatile esi = GetProcAddress;
98+
99+
100+
xor edi, edi
101+
102+
103+
;; nonvolatile edi = NULL;
104+
105+
106+
;; eax = GetProcAddress(ebx, "LoadLibraryA");
107+
push edi
108+
push 'Ayra'
109+
push 'rbiL'
110+
push 'daoL'
111+
push esp
112+
push ebx
113+
call esi
114+
115+
;; eax = LoadLibrary("user32");
116+
xor ecx, ecx
117+
push edi
118+
mov cx, '23'
119+
push ecx
120+
push 'resu'
121+
push esp
122+
call eax
123+
124+
;; eax = GetProcAddress(eax, "MessageBoxA")
125+
push edi
126+
push 0141786fh
127+
dec byte ptr [esp + 3h]
128+
push 'Bega'
129+
push 'sseM'
130+
push esp
131+
push eax
132+
call esi
133+
134+
;; eax = MessageBoxA(NULL, "Hello World!", NULL, MB_OK);
135+
push edi
136+
push '!dlr'
137+
push 'oW o'
138+
push 'lleH'
139+
mov ecx, esp
140+
push edi
141+
push edi
142+
push ecx
143+
push edi
144+
call eax
145+
146+
;; eax = GetProcAddress(ebx, "ExitProcess")
147+
push edi
148+
push 01737365h
149+
dec byte ptr [esp + 3h]
150+
push 'corP'
151+
push 'tixE'
152+
push esp
153+
push ebx
154+
call esi
155+
156+
;; ExitProcess(NULL);
157+
push edi
158+
call eax
159+
end start

‎windows/messagebox/messagebox32.exe‎

1 KB
Binary file not shown.

‎windows/messagebox/msg.c‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* This file was automatically generated by mkhex.sh,
3+
* which, together with the complete
4+
* and heavily commented assembly source code
5+
* for this shellcode, is available at
6+
* https://github.com/NoviceLive/shellcoding.
7+
*
8+
* For those curious heads
9+
* striving to figure out what's under the hood.
10+
*
11+
*/
12+
13+
14+
# include <stdlib.h>
15+
# include <stdio.h>
16+
# include <string.h>
17+
18+
# include <windows.h>
19+
20+
21+
int
22+
main(void)
23+
{
24+
char *shellcode = "\x33\xc9\x64\x8b\x49\x30\x8b\x49\x0c\x8b"
25+
"\x49\x1c\x8b\x59\x08\x8b\x41\x20\x8b\x09"
26+
"\x80\x78\x0c\x33\x75\xf2\x8b\xeb\x03\x6d"
27+
"\x3c\x8b\x6d\x78\x03\xeb\x8b\x45\x20\x03"
28+
"\xc3\x33\xd2\x8b\x34\x90\x03\xf3\x42\x81"
29+
"\x3e\x47\x65\x74\x50\x75\xf2\x81\x7e\x04"
30+
"\x72\x6f\x63\x41\x75\xe9\x8b\x75\x24\x03"
31+
"\xf3\x66\x8b\x14\x56\x8b\x75\x1c\x03\xf3"
32+
"\x8b\x74\x96\xfc\x03\xf3\x33\xff\x57\x68"
33+
"\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68"
34+
"\x4c\x6f\x61\x64\x54\x53\xff\xd6\x33\xc9"
35+
"\x57\x66\xb9\x33\x32\x51\x68\x75\x73\x65"
36+
"\x72\x54\xff\xd0\x57\x68\x6f\x78\x41\x01"
37+
"\xfe\x4c\x24\x03\x68\x61\x67\x65\x42\x68"
38+
"\x4d\x65\x73\x73\x54\x50\xff\xd6\x57\x68"
39+
"\x72\x6c\x64\x21\x68\x6f\x20\x57\x6f\x68"
40+
"\x48\x65\x6c\x6c\x8b\xcc\x57\x57\x51\x57"
41+
"\xff\xd0\x57\x68\x65\x73\x73\x01\xfe\x4c"
42+
"\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78"
43+
"\x69\x74\x54\x53\xff\xd6\x57\xff\xd0";
44+
45+
DWORD why_must_this_variable;
46+
BOOL ret = VirtualProtect (shellcode, strlen(shellcode),
47+
PAGE_EXECUTE_READWRITE, &why_must_this_variable);
48+
49+
if (!ret) {
50+
printf ("VirtualProtect\n");
51+
return EXIT_FAILURE;
52+
}
53+
54+
printf("strlen(shellcode)=%d\n", strlen(shellcode));
55+
56+
((void (*)(void))shellcode)();
57+
58+
return EXIT_SUCCESS;
59+
}

‎windows/messagebox/msg.exe‎

71.5 KB
Binary file not shown.

0 commit comments

Comments
 (0)