-
-
[技术专题]软件漏洞分析入门_6_初级shellcode_定位缓冲区
-
发表于: 2007-12-18 21:23
-
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
非常感谢这么好的资料！经过学习，成功了！哈哈！
 继续！
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#include <windows.h>
#include <stdio.h> #define DLL_NAME "user32.dll" main() { BYTE* ptr; int position,address; HINSTANCE handle; BOOL done_flag = FALSE; handle=LoadLibrary(DLL_NAME); if(!handle) { printf(" load dll erro !"); exit(0); } ptr = (BYTE*)handle; for(position = 0; !done_flag; position++) { try { if(ptr[position] == 0xFF && ptr[position+1] == 0xE4) { //0xFFE4 is the opcode of jmp esp int address = (int)ptr + position; printf("OPCODE found at 0x%x\n",address); } } catch(...) { int address = (int)ptr + position; printf("END OF 0x%x\n", address); done_flag = true; } } } 这断代码在debug下可以正常运行，不过在release版本下会报错， 把try...catch(...).. 改成_try...__except(EXCEPTION_EXECUTE_HANDLER )...就没问题了 
|
|
|
我想问下，为什么我搜索的结果这么少，而且搜索不到类似于下面这段 Location found: call esp in user32  |
|
|
我也来吱一下
|
|
|
|
