浅析shellcode 反汇编模拟运行及调试方法

import binascii
filename = "C:\\Users\\liang\\Desktop\\工作相关\\样本\\rdpscan\\rdpscan\\ssleay32.dll"
#filename = "C:\\Users\\liang\\Desktop\\payload"

shellcode = "{"
ctr = 1
maxlen = 15

for b in open(filename, "rb").read():
 shellcode += "0x" + str(binascii.hexlify(b.to_bytes(length=1, byteorder='big')))[2:4] + ","
 if ctr == maxlen:
 shellcode += "\n"
 ctr = 0
 ctr += 1
shellcode = shellcode[:-1] + "}"
print(shellcode)

#include <windows.h>
#include <stdio.h>
#include <string.h>
#pragma comment(linker, "/section:.data,RWE") 
unsigned char shellcode[] = 复制到这里
typedef void(__stdcall* CODE) ();
int main()
{
 PVOID p = NULL;
 if ((p = VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)) == NULL)
 MessageBoxA(NULL, "申请内存失败", "提醒", MB_OK);
 if (!(memcpy(p, shellcode, sizeof(shellcode))))
 MessageBoxA(NULL, "写内存失败", "提醒", MB_OK);
 CODE code = (CODE)p;
 code();
 return 0;
}

 # A breakpoint callback takes the jitter as first parameterdef dump(jitter):
  # Dump data ad address run_addr with a length of len(data)
  new_data = jitter.vm.get_mem(run_addr, len(data))
  # Save to disk
  open('/tmp/dump.bin', 'wb').write(new_data)
  # Stop execution
  return False

 # Register a callback to the breakpointmyjit.add_breakpoint(0x4000004b, dump)...myjit.cpu.EAX = 0x40000000myjit.init_run(run_addr)myjit.continue_run()

def urlmon_URLDownloadToCacheFileW(jitter):
  ret_ad, args = jitter.func_args_stdcall(["lpunkcaller",
             "szurl",
             "szfilename",
             "ccfilename",
             "reserved",
             "pbsc"])
  url = jitter.get_str_unic(args.szurl)
  print "URL:", url
  jitter.set_str_unic(args.szfilename, "toto")
  jitter.func_ret_stdcall(ret_ad, 0)

import sys
from elfesteem import pe_init

# Get the shellcode
data = open(sys.argv[1]).read()
# Generate a PE
pe = pe_init.PE(wsize=32)
# Add a ".text" section containing the shellcode to the PE
s_text = pe.SHList.add_section(name=".text", addr=0x1000, data=data)
# Set the entrypoint to the shellcode's address
pe.Opthdr.AddressOfEntryPoint = s_text.addr
# Write the PE to "sc_pe.py"
open('sc_pe.exe', 'w').write(str(pe))