C语言 C程序中的Shellcode
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/16626857/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Shellcode in C program
提问by user720694
In Demystifying the Execve Shellcodeis explained a way to write an execve shellcode:
在Demystifying the Execve Shellcode中解释了一种编写 execve shellcode 的方法：
#include<stdio.h>
#include<string.h>
unsigned char code[] =
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
What does the line int (*ret)() = (int(*)())code;do?
线有int (*ret)() = (int(*)())code;什么作用？
回答by masoud
int (*ret)() = (int(*)())code;
~~~~~~~~~~~~ ~~~~~~~~~~~~~~
1 2
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3
It defines
retas a pointer to a function which has no parameter()and returnsint. So, Those()indicates the definition of parameters of a function.It's for casting
codeto a pointer to a function which has no parameter()and returnsint.Casts
codeas a function and assigns it toret. After that you can callret();.
它定义
ret为指向没有参数()并返回的函数的指针int。所以，那些()表示函数参数的定义。它用于转换
code为指向没有参数()并返回的函数的指针int。转换
code为函数并将其分配给ret. 之后就可以调用了ret();。
unsigned char code[] = "\x31\xc0\x50\x68\x6e\x2f\...
It is a sequence of machine instructions represented by hex values. It will be injected to the code as a function.
它是由十六进制值表示的机器指令序列。它将作为函数注入到代码中。
回答by Jeremy
(*(void(*)())shellcode)()
==
==
p = (void(*)()) shellcode;
(*p)();
回答by Patrice Levesque
The int line declares the ret() function, by pointing to the code[] array; in other words, the function is mapped to the code[] binary instructions.
int 行通过指向 code[] 数组来声明 ret() 函数；换句话说，函数被映射到 code[] 二进制指令。
The \x construct is a safe way to embed hexadecimal characters in a string. You could for instance replace “\x31” by “1” as the character code of “1” is 49, or hexadecimal 31.
\x 构造是在字符串中嵌入十六进制字符的安全方法。例如，您可以将“\x31”替换为“1”，因为“1”的字符代码是 49，或十六进制 31。
回答by Robert Larsen
Can this function pointer part be re-written in a simpler form?
这个函数指针部分可以用更简单的形式重写吗？
I don't know if you think this is simpler, but maybe:
我不知道你是否认为这更简单，但也许：
#include <stdio.h>
#include <string.h>
unsigned char code[] =
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
typedef int(*shellcode_t)();
int main(int argc, char ** argv) {
printf("Shellcode Length: %ld\n", strlen(code));
shellcode_t ret = (shellcode_t)code;
ret();
}
