Skip to content

Instantly share code, notes, and snippets.

@7shi
Forked from bencz/main.cpp
Last active December 14, 2015 04:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save 7shi/5026536 to your computer and use it in GitHub Desktop.
Save 7shi/5026536 to your computer and use it in GitHub Desktop.
#include <cstdio>
#include <vector>
#include <windows.h>
using namespace std;
class Buffer: public vector<unsigned char>
{
public:
void push_dword(DWORD dw)
{
push_back(dw);
push_back(dw >> 8);
push_back(dw >> 16);
push_back(dw >> 24);
}
void push_ptr(const void *p)
{
push_dword(reinterpret_cast<DWORD>(p));
}
int Execute()
{
char *func = reinterpret_cast<char *>(VirtualAlloc(
0, size() + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE ));
memcpy( func, data(), size() );
func[size()] = 0xC3; // add the ret to the final of code final
int ret = (*reinterpret_cast<int(*)()>(func))();
VirtualFree( func, 0, MEM_RELEASE );
return ret;
}
};
int main()
{
Buffer code;
// push MESSAGE
const char* ohi = "HI\n";
code.push_back( 0x68 );
code.push_ptr( ohi );
// mov eax, printf
code.push_back( 0xb8 );
code.push_ptr( reinterpret_cast<void *>(&printf) );
// call eax
code.push_back( 0xff );
code.push_back( 0xd0 );
// add esp, 4
code.push_back( 0x83 );
code.push_back( 0xc4 );
code.push_back( 0x04 );
int exec = code.Execute();
printf("SUM = %d\n", exec);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment