shellcode无法验证
初学shellcode,照抄了一个shellcode后,执行报access violation异常,代码如下:
char shellcode[]="\x55\x8B\xEC\x33\xFF\x57\x57\x83\xEC\x10\x66\xC7\x45\xEA\x6D\x00\x66\xC7\x45\xEC\x73\x00\x66\xC7\x45\xEE\x76\x00\x66\xC7\x45\xF0\x63\x00\x66\xC7\x45\xF2\x72\x00\x66\xC7\x45\xF4\x74\x00\x66\xC7\x45\xF6\x2E\x00\x66\xC7\x45\xF8\x64\x00\x66\xC7\x45\xFA\x6C\x00\x66\xC7\x45\xFC\x6C\x00\x8D\x45\xEA\x50\xB8\xD2\x28\x65\x76\xFF\xD0\x83\xC4\x18\x33\xFF\x57\x83\xEC\x08\xC6\x45\xF4\x63\xC6\x45\xF5\x6F\xC6\x45\xF6\x6D\xC6\x45\xF7\x6D\xC6\x45\xF8\x61\xC6\x45\xF9\x6E\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6\x45\xFC\x63\xC6\x45\xFD\x6F\xC6\x45\xFE\x6D\x8D\x45\xF4\x50\xB8\x6F\xB1\xD1\x75\xFF\xD0\x83\xC4\x0C\x8B\xE5\x5D";
int main()
{	
	( (void(*)(void)) shellcode )();
	return 0;
}
异常代码如下:
Unhandled exception at 0x01137000 in codeTest.exe: 0xC0000005: Access violation.
0x01137000 该地址是shellcode的起始地址;
猜测是因为shellcode放在静态数据段中,该段没有可执行的属性,故导致该异常,但是放在堆栈中也不行,报同样错误,如果是这个原因的话,那现在的程序就能够区分开数据和代码了,shellcode还有什么用处? 求解答
如果不是因为这个原因的话,又是为什么呢?
------解决方案--------------------
首先这段shellcode在反汇编里面是这个样子:
00421C3A    55                              push    ebp
00421C3B    8BEC                            mov     ebp, esp
00421C3D    33FF                            xor     edi, edi
00421C3F    57                              push    edi
00421C40    57                              push    edi
00421C41    83EC 10                         sub     esp, 10
00421C44    66:C745 EA 6D00                 mov     word ptr ss:[ebp-16], 6D
00421C4A    66:C745 EC 7300                 mov     word ptr ss:[ebp-14], 73
00421C50    66:C745 EE 7600                 mov     word ptr ss:[ebp-12], 76
00421C56    66:C745 F0 6300                 mov     word ptr ss:[ebp-10], 63
00421C5C    66:C745 F2 7200                 mov     word ptr ss:[ebp-E], 72
00421C62    66:C745 F4 7400                 mov     word ptr ss:[ebp-C], 74
00421C68    66:C745 F6 2E00                 mov     word ptr ss:[ebp-A], 2E
00421C6E    66:C745 F8 6400                 mov     word ptr ss:[ebp-8], 64
00421C74    66:C745 FA 6C00                 mov     word ptr ss:[ebp-6], 6C
00421C7A    66:C745 FC 6C00                 mov     word ptr ss:[ebp-4], 6C
00421C80    8D45 EA                         lea     eax, dword ptr ss:[ebp-16]
00421C83    50                              push    eax
00421C84    B8 D2286576                     mov     eax, 766528D2
00421C89    FFD0                            call    eax
00421C8B    83C4 18                         add     esp, 18
00421C8E    33FF                            xor     edi, edi
00421C90    57                              push    edi
00421C91    83EC 08                         sub     esp, 8
00421C94    C645 F4 63                      mov     byte ptr ss:[ebp-C], 63
00421C98    C645 F5 6F                      mov     byte ptr ss:[ebp-B], 6F
00421C9C    C645 F6 6D                      mov     byte ptr ss:[ebp-A], 6D
00421CA0    C645 F7 6D                      mov     byte ptr ss:[ebp-9], 6D
00421CA4    C645 F8 61                      mov     byte ptr ss:[ebp-8], 61
00421CA8    C645 F9 6E                      mov     byte ptr ss:[ebp-7], 6E
00421CAC    C645 FA 64                      mov     byte ptr ss:[ebp-6], 64
00421CB0    C645 FB 2E                      mov     byte ptr ss:[ebp-5], 2E
00421CB4    C645 FC 63                      mov     byte ptr ss:[ebp-4], 63
00421CB8    C645 FD 6F                      mov     byte ptr ss:[ebp-3], 6F
00421CBC    C645 FE 6D                      mov     byte ptr ss:[ebp-2], 6D
00421CC0    8D45 F4                         lea     eax, dword ptr ss:[ebp-C]
00421CC3    50                              push    eax
00421CC4    B8 6FB1D175