├── ShellCode32
    ├── shellcode.h
    ├── ShellCode32.vcxproj.user
    ├── ShellCode32.vcxproj.filters
    ├── ShellCode32.sln
    ├── ShellCode32.cpp
    └── ShellCode32.vcxproj
├── shellcode64
    ├── GetModule.asm
    ├── shellcode64.h
    ├── shellcode64.vcxproj.user
    ├── shellcode64.vcxproj.filters
    ├── shellcode64.sln
    ├── shellcode64.cpp
    └── shellcode64.vcxproj
├── images
    └── cpp开发shellcode模板
    │   ├── image-20231010114027186.png
    │   ├── image-20231010114101960.png
    │   ├── image-20231010133731851.png
    │   ├── image-20231010133759283.png
    │   └── image-20231010133816209.png
└── README.md


/ShellCode32/shellcode.h:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/ShellCode32/shellcode.h


--------------------------------------------------------------------------------
/shellcode64/GetModule.asm:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/shellcode64/GetModule.asm


--------------------------------------------------------------------------------
/shellcode64/shellcode64.h:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/shellcode64/shellcode64.h


--------------------------------------------------------------------------------
/images/cpp开发shellcode模板/image-20231010114027186.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/images/cpp开发shellcode模板/image-20231010114027186.png


--------------------------------------------------------------------------------
/images/cpp开发shellcode模板/image-20231010114101960.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/images/cpp开发shellcode模板/image-20231010114101960.png


--------------------------------------------------------------------------------
/images/cpp开发shellcode模板/image-20231010133731851.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/images/cpp开发shellcode模板/image-20231010133731851.png


--------------------------------------------------------------------------------
/images/cpp开发shellcode模板/image-20231010133759283.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/images/cpp开发shellcode模板/image-20231010133759283.png


--------------------------------------------------------------------------------
/images/cpp开发shellcode模板/image-20231010133816209.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clownfive/CppDevShellcode/HEAD/images/cpp开发shellcode模板/image-20231010133816209.png


--------------------------------------------------------------------------------
/ShellCode32/ShellCode32.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup />
4 | </Project>


--------------------------------------------------------------------------------
/shellcode64/shellcode64.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup />
4 | </Project>


--------------------------------------------------------------------------------
/ShellCode32/ShellCode32.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="源文件">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="头文件">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="资源文件">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="ShellCode32.cpp">
19 |       <Filter>源文件</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 |   <ItemGroup>
23 |     <ClInclude Include="shellcode.h">
24 |       <Filter>头文件</Filter>
25 |     </ClInclude>
26 |   </ItemGroup>
27 | </Project>


--------------------------------------------------------------------------------
/shellcode64/shellcode64.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="源文件">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="头文件">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="资源文件">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="shellcode64.cpp">
19 |       <Filter>源文件</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 |   <ItemGroup>
23 |     <MASM Include="GetModule.asm">
24 |       <Filter>源文件</Filter>
25 |     </MASM>
26 |   </ItemGroup>
27 |   <ItemGroup>
28 |     <ClInclude Include="shellcode64.h">
29 |       <Filter>头文件</Filter>
30 |     </ClInclude>
31 |   </ItemGroup>
32 | </Project>


--------------------------------------------------------------------------------
/ShellCode32/ShellCode32.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio Version 16
 4 | VisualStudioVersion = 16.0.33529.622
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ShellCode32", "ShellCode32.vcxproj", "{3E3F5F91-09AE-46BA-967C-C518B71715A9}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|x64 = Debug|x64
11 | 		Debug|x86 = Debug|x86
12 | 		Release|x64 = Release|x64
13 | 		Release|x86 = Release|x86
14 | 	EndGlobalSection
15 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Debug|x64.ActiveCfg = Debug|x64
17 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Debug|x64.Build.0 = Debug|x64
18 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Debug|x86.ActiveCfg = Debug|Win32
19 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Debug|x86.Build.0 = Debug|Win32
20 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Release|x64.ActiveCfg = Release|x64
21 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Release|x64.Build.0 = Release|x64
22 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Release|x86.ActiveCfg = Release|Win32
23 | 		{3E3F5F91-09AE-46BA-967C-C518B71715A9}.Release|x86.Build.0 = Release|Win32
24 | 	EndGlobalSection
25 | 	GlobalSection(SolutionProperties) = preSolution
26 | 		HideSolutionNode = FALSE
27 | 	EndGlobalSection
28 | 	GlobalSection(ExtensibilityGlobals) = postSolution
29 | 		SolutionGuid = {B8ABB6FC-C1E2-4EFF-84BD-30566F716F26}
30 | 	EndGlobalSection
31 | EndGlobal
32 | 


--------------------------------------------------------------------------------
/shellcode64/shellcode64.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio Version 16
 4 | VisualStudioVersion = 16.0.33529.622
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "shellcode64", "shellcode64.vcxproj", "{89EA323E-821A-4C99-97EB-80A5DE65F2AB}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|x64 = Debug|x64
11 | 		Debug|x86 = Debug|x86
12 | 		Release|x64 = Release|x64
13 | 		Release|x86 = Release|x86
14 | 	EndGlobalSection
15 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Debug|x64.ActiveCfg = Debug|x64
17 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Debug|x64.Build.0 = Debug|x64
18 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Debug|x86.ActiveCfg = Debug|Win32
19 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Debug|x86.Build.0 = Debug|Win32
20 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Release|x64.ActiveCfg = Release|x64
21 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Release|x64.Build.0 = Release|x64
22 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Release|x86.ActiveCfg = Release|Win32
23 | 		{89EA323E-821A-4C99-97EB-80A5DE65F2AB}.Release|x86.Build.0 = Release|Win32
24 | 	EndGlobalSection
25 | 	GlobalSection(SolutionProperties) = preSolution
26 | 		HideSolutionNode = FALSE
27 | 	EndGlobalSection
28 | 	GlobalSection(ExtensibilityGlobals) = postSolution
29 | 		SolutionGuid = {6DE21609-A2A0-44FC-BC7E-C4B135FC449C}
30 | 	EndGlobalSection
31 | EndGlobal
32 | 


--------------------------------------------------------------------------------
/shellcode64/shellcode64.cpp:
--------------------------------------------------------------------------------
 1 | #include "shellcode64.h"
 2 | 
 3 | #include <stdio.h>
 4 | 
 5 | //这是shellcode的入口函数
 6 | void ShellCodeEntry()
 7 | {
 8 | 	SCENV env;
 9 | 	InitEnv(&env);
10 | 
11 | 	char sz_hello[] = { 'h','e','l','l','o','\0' };
12 | 	env.m_pfnMessageBoxA(NULL, sz_hello, sz_hello, MB_OK);
13 | 	//代码冲这开始写
14 | 
15 | 
16 | }
17 | 
18 | void InitEnv(PSCENV pEnv)
19 | {
20 | 	char sz_MessageBoxA[] = { 'M','e','s','s','a','g','e','B','o','x','A','\0' };
21 | 	char sz_LoadLibraryA[] = { 'L','o','a','d','L','i','b','r','a','r','y','A','\0' };
22 | 	char sz_GetProcAddress[] = { 'G','e','t','P','r','o','c','A','d','d','r','e','s','s','\0' };
23 | 	char sz_user32[] = { 'u','s','e','r','3','2','\0' };
24 | 
25 | 	//拿kernel32的地址
26 | 	HMODULE hKernel32 = GetModuleKernel();
27 | 	pEnv->m_pfnGetProcAddress = (PFN_GetProcAddress)MyGetProcAddress(hKernel32, sz_GetProcAddress);
28 | 	pEnv->m_pfnLoadLibraryA = (PFN_LoadLibraryA)pEnv->m_pfnGetProcAddress(hKernel32, sz_LoadLibraryA);
29 | 	
30 | 	
31 | 	HMODULE hUser32 = pEnv->m_pfnLoadLibraryA(sz_user32);
32 | 	pEnv->m_pfnMessageBoxA = (PFN_MessageBoxA)pEnv->m_pfnGetProcAddress(hUser32, sz_MessageBoxA);
33 | 
34 | 
35 | 
36 | }
37 | 
38 | int MyStrCmp(char* pDst, char* pSrc)
39 | {
40 | 	char* pDstTmp = pDst;
41 | 	char* pSrcTmp = pSrc;
42 | 	while (*pSrcTmp && *pDstTmp)
43 | 	{
44 | 		if (*pSrcTmp != *pDstTmp)
45 | 		{
46 | 			return *pDstTmp - *pSrcTmp;
47 | 		}
48 | 		pSrcTmp++;
49 | 		pDstTmp++;
50 | 	}
51 | 
52 | 	return *pDstTmp - *pSrcTmp;
53 | }
54 | 
55 | FARPROC MyGetProcAddress(HMODULE hModule, char* lpProcName) {
56 | 	IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)hModule;
57 | 	IMAGE_NT_HEADERS64* pNtHeaders = (IMAGE_NT_HEADERS64*)((char*)pDosHeader + pDosHeader->e_lfanew);
58 | 
59 | 	//LPVOID exports1 = (LPVOID)&(pNtHeaders->OptionalHeader.DataDirectory[0]);
60 | 	//DWORD exports2 =  pNtHeaders->OptionalHeader.DataDirectory[0].VirtualAddress;
61 | 
62 | 	IMAGE_EXPORT_DIRECTORY* pExportDir = (IMAGE_EXPORT_DIRECTORY*)((char*)pDosHeader + pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
63 | 
64 | 	DWORD* pAddressOfNames = (DWORD*)((char*)pDosHeader + pExportDir->AddressOfNames);
65 | 	WORD* pAddressOfOrdinals = (WORD*)((char*)pDosHeader + pExportDir->AddressOfNameOrdinals);
66 | 	DWORD* pAddressOfFunctions = (DWORD*)((char*)pDosHeader + pExportDir->AddressOfFunctions);
67 | 
68 | 	for (DWORD i = 0; i < pExportDir->NumberOfNames; i++) {
69 | 		LPCSTR pProcName = (LPCSTR)((char*)pDosHeader + pAddressOfNames[i]);
70 | 		if (MyStrCmp((char*)pProcName, lpProcName) == 0) {
71 | 			WORD ordinal = pAddressOfOrdinals[i];
72 | 			DWORD functionRVA = pAddressOfFunctions[ordinal];
73 | 			FARPROC functionPtr = (FARPROC)((char*)hModule + functionRVA);
74 | 			return functionPtr;
75 | 		}
76 | 	}
77 | 	return NULL;
78 | }


--------------------------------------------------------------------------------
/ShellCode32/ShellCode32.cpp:
--------------------------------------------------------------------------------
  1 | #include "shellcode.h"
  2 | 
  3 | 
  4 | //函数入口点
  5 | void ShellCodeOEP()
  6 | {
  7 | 	SCENV env;
  8 | 	InitEnv(&env);
  9 | 
 10 | 	char sz_hello[] = { 'h','e','l','l','o','\0' };
 11 | 	env.m_pfnMessageBoxA(NULL, sz_hello, sz_hello, MB_OK);
 12 | 
 13 | }
 14 | 
 15 | void InitEnv(PSCENV pEnv)
 16 | {
 17 | 	char sz_MessageBoxA[] = { 'M','e','s','s','a','g','e','B','o','x','A','\0' };
 18 | 	char sz_LoadLibraryA[] = { 'L','o','a','d','L','i','b','r','a','r','y','A','\0' };
 19 | 	char sz_GetProcAddress[] = { 'G','e','t','P','r','o','c','A','d','d','r','e','s','s','\0' };
 20 | 	char sz_user32[] = { 'u','s','e','r','3','2','\0' };
 21 | 
 22 | 
 23 | 
 24 | 	//拿kernel32的地址
 25 | 	HMODULE hKernel32 = GetKernel32Base();
 26 | 	pEnv->m_pfnGetProcAddress = (PFN_GetProcAddress)MyGetProcAddress(hKernel32, sz_GetProcAddress);
 27 | 	pEnv->m_pfnLoadLibraryA = (PFN_LoadLibraryA)pEnv->m_pfnGetProcAddress(hKernel32, sz_LoadLibraryA);
 28 | 
 29 | 	HMODULE hUser32 = pEnv->m_pfnLoadLibraryA(sz_user32);
 30 | 	pEnv->m_pfnMessageBoxA = (PFN_MessageBoxA)pEnv->m_pfnGetProcAddress(hUser32, sz_MessageBoxA);
 31 | 
 32 | 
 33 | 
 34 | }
 35 | 
 36 | //拿kernel32模块基址
 37 | HMODULE GetKernel32Base()
 38 | {
 39 | 
 40 | 	HMODULE hKer32 = NULL;
 41 | 	__asm
 42 | 	{
 43 | 		mov eax, fs: [0x18] ; //TEB
 44 | 		mov eax, [eax + 0x30]; //PEB
 45 | 		mov eax, [eax + 0x0C];//_PEB_LDR_DATA
 46 | 		mov eax, [eax + 0x0C];  // _LIST_ENTRY 主模块
 47 | 		mov eax, [eax]
 48 | 		mov eax, [eax]
 49 | 		mov eax, dword ptr[eax + 0x18];// KERNEL32基址
 50 | 		mov hKer32, eax
 51 | 
 52 | 	}
 53 | 	return hKer32;
 54 | }
 55 | 
 56 | int MyStrCmp(char* pDst, char* pSrc)
 57 | {
 58 | 	char* pDstTmp = pDst;
 59 | 	char* pSrcTmp = pSrc;
 60 | 	while (*pSrcTmp && *pDstTmp)
 61 | 	{
 62 | 		if (*pSrcTmp != *pDstTmp)
 63 | 		{
 64 | 			return *pDstTmp - *pSrcTmp;
 65 | 		}
 66 | 		pSrcTmp++;
 67 | 		pDstTmp++;
 68 | 	}
 69 | 
 70 | 	return *pDstTmp - *pSrcTmp;
 71 | }
 72 | 
 73 | 
 74 | FARPROC MyGetProcAddress(HMODULE hDll, char* szFuncName)
 75 | {
 76 | 	if (hDll == NULL || szFuncName == NULL)
 77 | 	{
 78 | 		return NULL;
 79 | 	}
 80 | 
 81 | 	//处理pe头
 82 | 	PIMAGE_DOS_HEADER pDosHdr = (PIMAGE_DOS_HEADER)hDll;
 83 | 	PIMAGE_NT_HEADERS pNtHdr = (PIMAGE_NT_HEADERS)((int)hDll + (int)pDosHdr->e_lfanew);
 84 | 	PIMAGE_OPTIONAL_HEADER pOptionHeader = (PIMAGE_OPTIONAL_HEADER)&pNtHdr->OptionalHeader; //可选头
 85 | 
 86 | 
 87 | 	PIMAGE_DATA_DIRECTORY pExportDir = (PIMAGE_DATA_DIRECTORY)pOptionHeader->DataDirectory + IMAGE_DIRECTORY_ENTRY_EXPORT;
 88 | 
 89 | 	PIMAGE_EXPORT_DIRECTORY pExportTable = (PIMAGE_EXPORT_DIRECTORY)(int)(pOptionHeader->DataDirectory[0].VirtualAddress + (int)hDll);
 90 | 
 91 | 
 92 | 	PDWORD pdwAddressofNames = (PDWORD)(pExportTable->AddressOfNames + (int)hDll); //二级名称指针
 93 | 	PWORD pdwAddressofNameOrdinals = (PWORD)(pExportTable->AddressOfNameOrdinals + (int)hDll);
 94 | 	PDWORD pdwAddressOfFunc = (PDWORD)(pExportTable->AddressOfFunctions + (int)hDll);
 95 | 	DWORD dwFuncCount = pExportTable->NumberOfFunctions;
 96 | 
 97 | 		//名称获取函数地址
 98 | 		for (int i = 0; i < (int)dwFuncCount; i++)
 99 | 		{
100 | 			//获取名称地址
101 | 			char* pszName = (char*)(pdwAddressofNames[i] + (int)hDll);
102 | 			if (MyStrCmp(pszName, szFuncName) == 0)
103 | 			{
104 | 				DWORD dwIdx = pdwAddressofNameOrdinals[i]; // + pExportTable->Base
105 | 				//找到函数地址
106 | 				DWORD dwFunAddr = pdwAddressOfFunc[dwIdx] + (int)hDll;
107 | 				return FARPROC(dwFunAddr);
108 | 
109 | 			}
110 | 		}
111 | 	return NULL;
112 | }


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # CppDevShellcode
  2 | 
  3 | 
  4 | 
  5 | ## 前言：
  6 | 
  7 | 网络上推荐开发shellcode是用Clang、或者python开发，有些博客直接用的汇编在写。
  8 | 
  9 | 为了简化开发的难度，并且windows上还是主推Visual Studio写cpp。
 10 | 
 11 | 所以就有了这个使用Visual Studio开发shellcode的项目。
 12 | 
 13 | **开发基础：cpp、win32编程、pe结构、x64/x32汇编**
 14 | 
 15 | 
 16 | 
 17 | ## 0x01 开发环境配置
 18 | 
 19 | 1. 保证随机基址开启（VS默认开启随机基址）
 20 | 2. Debug改成Release模式 （测试的时候也可以用debug，最后生成的时候改成Release就行）
 21 | 3. 修改入口函数（不能使用默认的main函数，vs在调用main函数之前做了很多处理导致代码会出现**绝对地址**）
 22 | 4. 关闭GS选项
 23 | 5. 关闭优化
 24 | 6. 使用静态库
 25 | 
 26 | ### 图文
 27 | 
 28 | 1）修改入口函数(32位)
 29 | 
 30 | ![image-20231010133731851](images/cpp开发shellcode模板/image-20231010133731851.png)
 31 | 
 32 | 2）关闭gs
 33 | 
 34 | ![image-20231010133759283](images/cpp开发shellcode模板/image-20231010133759283.png)
 35 | 
 36 | 3）关闭优化，调成静态库
 37 | 
 38 | ![image-20231010133816209](images/cpp开发shellcode模板/image-20231010133816209.png)
 39 | 
 40 | 
 41 | 
 42 | ### 64位环境配置
 43 | 
 44 | 由于微软不给在64位cpp代码中插入汇编指令，并且所有调用约定都是FASTCALL。需要使用联合编译汇编才行
 45 | 
 46 | 1. 新建一个name.asm文件（文件名不能和项目名一样）
 47 | 2. 项目属性-》生成依赖项-》生成自定义 ----》吧masm选项勾上
 48 | 3. 右键asm文件属性-》项目类型选择asm
 49 | 
 50 | 图文：
 51 | 
 52 | 1）项目生成依赖项
 53 | 
 54 | ![image-20231010114101960](images/cpp开发shellcode模板/image-20231010114101960.png)
 55 | 
 56 | 2）asm属性
 57 | 
 58 | ![image-20231010114027186](images/cpp开发shellcode模板/image-20231010114027186.png)
 59 | 
 60 | -----------------------
 61 | 
 62 | 
 63 | 
 64 | ## 0x02 拿kernel32模块基址
 65 | 
 66 | fs寄存器中保存了tep和peb的地址，
 67 | 
 68 | peb中保存了ldr结构体
 69 | 
 70 | ```
 71 | HMODULE GetKernel32Base()
 72 | {
 73 | 	
 74 | 	HMODULE hKer32 = NULL;
 75 | 	__asm
 76 | 	{
 77 | 		mov eax, fs: [0x18] ; //TEB
 78 | 		mov eax, [eax + 0x30]; //PEB
 79 | 		mov eax, [eax + 0x0C];//_PEB_LDR_DATA
 80 | 		mov eax, [eax + 0x0C];  // _LIST_ENTRY 主模块
 81 | 		mov eax, [eax]
 82 | 		mov eax, [eax]
 83 | 		mov eax, dword ptr[eax + 0x18];// KERNEL32基址
 84 | 		mov hKer32, eax
 85 | 
 86 | 	}
 87 | 	return hKer32;
 88 | }
 89 | ```
 90 | 
 91 | 
 92 | 
 93 | ## 0x03 自己实现GetProcAddress函数
 94 | 
 95 | 自己实现GetProcAddress函数，去获取kernel32中的 LoadLibraryA 、GetProcAddress等函数地址
 96 | 
 97 | 获取到函数地址之后转成函数指针调用。
 98 | 
 99 | 原理：
100 | 
101 | 	1. 拿到kernel模块基址就是MZ的地址
102 | 	1. 解析pe文件格式
103 | 	1. 定位导出表
104 | 	1. 找到指定导出表中函数名称
105 | 	1. 再去拿指定函数的地址，并且返回
106 | 
107 | 这里就不贴代码了，由于是自己实现的函数下文统称MyGetProcAddress。
108 | 
109 | **注意：需要解析pe文件所以64位的和32位的MyGetProcAddress不通用。**
110 | 
111 | 
112 | 
113 | ## 0x04 保存函数地址
114 | 
115 | shellcode开发不能有绝对地址也就不能使用全局变量，所以需要一个结构体来保存函数指针。
116 | 
117 | 函数调用的时候专递结构体指针就能拿到函数地址。
118 | 
119 | 这里就新建一个头文件，把结构体和函数声明都放到这个头文件里面去
120 | 
121 | ```hpp
122 | //windowsapi 函数指针声明
123 | typedef int (WINAPI* PFN_MessageBoxA)(HWND, LPCSTR, LPCSTR, UINT);
124 | typedef HMODULE(WINAPI* PFN_LoadLibraryA)(LPCSTR);
125 | typedef FARPROC(WINAPI* PFN_GetProcAddress)(HMODULE, LPCSTR);
126 | 
127 | //存函数地址的结构体
128 | typedef	struct SellcodeEvn
129 | {
130 | 	PFN_MessageBoxA m_pfnMessageBoxA;
131 | 	PFN_LoadLibraryA m_pfnLoadLibraryA;
132 | 	PFN_GetProcAddress m_pfnGetProcAddress;
133 | 
134 | 
135 | }SCENV, * PSCENV;
136 | 
137 | //函数的声明
138 | EXTERN_C HMODULE GetModuleKernel();
139 | FARPROC MyGetProcAddress(HMODULE hModule, char* lpProcName);
140 | ```
141 | 
142 | 
143 | 
144 | ## 0x05 拿api函数地址
145 | 
146 | 1)MyGetProcAddress函数第一个参数是模块基址，第二个参数是函数名。
147 | 
148 | 2）**不能有char*类型的变量**（否则会被放到数据区，产生绝对地址）
149 | 
150 | 
151 | 
152 | ```
153 | void InitEnv(PSCENV pEnv)
154 | {
155 | 	char sz_MessageBoxA[] = { 'M','e','s','s','a','g','e','B','o','x','A','\0' };
156 | 	char sz_LoadLibraryA[] = { 'L','o','a','d','L','i','b','r','a','r','y','A','\0' };
157 | 	char sz_GetProcAddress[] = { 'G','e','t','P','r','o','c','A','d','d','r','e','s','s','\0' };
158 | 	char sz_user32[] = { 'u','s','e','r','3','2','\0' };
159 | 
160 | 	//拿kernel32的地址
161 | 	HMODULE hKernel32 = GetModuleKernel();
162 | 	pEnv->m_pfnGetProcAddress = (PFN_GetProcAddress)MyGetProcAddress(hKernel32, sz_GetProcAddress);
163 | 	pEnv->m_pfnLoadLibraryA = (PFN_LoadLibraryA)pEnv->m_pfnGetProcAddress(hKernel32, sz_LoadLibraryA);
164 | 	
165 | 	HMODULE hUser32 = pEnv->m_pfnLoadLibraryA(sz_user32);
166 | 	pEnv->m_pfnMessageBoxA = (PFN_MessageBoxA)pEnv->m_pfnGetProcAddress(hUser32, sz_MessageBoxA);
167 | }
168 | ```
169 | 
170 | PS：自己开发一个char* 转char数组的工具，以及api函数转函数指针。 **或者让GPT给你转也行。**
171 | 
172 | 
173 | 
174 | ## 0x06 入口点调用函数完成自己的功能
175 | 
176 | 入口函数之前不能放别的函数。第一个函数只能是入口函数。
177 | 
178 | ```
179 | //这是shellcode的入口函数
180 | void ShellCodeOEP()
181 | {
182 | 	SCENV env; //存放函数地址的结构体
183 | 	InitEnv(&env); //给结构体赋值函数地址
184 | 
185 | 	//测试代码messageboxa
186 | 	char sz_hello[] = { 'h','e','l','l','o','\0' };
187 | 	env.m_pfnMessageBoxA(NULL, sz_hello, sz_hello, MB_OK);
188 | 	//代码从这开始写
189 | 
190 | 
191 | }
192 | ```
193 | 
194 | 这里只做了一个messageboxa，需要什么功能照着模板写就是了 。
195 | 
196 | 也可以先生成DEBUG版本的调试一下，无错误再生成Release版本。
197 | 
198 | 用2进制编辑器打开生成的pe文件，拷贝.text节区的所有内容即可完成shellcode制作。
199 | 
200 | 2进制编辑器 010Editor、winhex都行。
201 | 
202 | 
203 | 
204 | ## 0x07 64位--汇编拿kernel32基址
205 | 
206 | 需要联合编译，拿基址的汇编代码只能单独写到.asm  文件里面。联合编译在头文件里面定义函数声明调用。
207 | 
208 | 
209 | 
210 | shellcode.asm
211 | 
212 | ```asm
213 | .code
214 | GetModuleKernel proc
215 | 	xor r8, r8
216 | 	xor rax, rax
217 | 	xor r10, r10
218 | 	add r10, 60h
219 | 	mov rax, gs:[r10]     ;通过GS寄存器获取PEB基址
220 | 	mov rax, [rax + 18h]  ;获取PEB中Ldr数据结构的基址
221 | 	mov rax, [rax + 10h]  ;获取Ldr数据结构的InmemoryOrderModuleList字段的基址
222 | 	mov rax, [rax]		   ;获取InmemoryOrderModuleList链表第一个节点 用这个取就是ntdll的基址
223 | 	mov rax, [rax]		   ;获取InmemoryOrderModuleList链表第一个节点  用这个就是kernen32的基址
224 | 	mov rax, [rax + 30h]  ;获取节点中BaseAddress字段，既kernel32.dll的基址
225 | 	ret
226 | GetModuleKernel endp
227 | end
228 | ```
229 | 
230 | 
231 | 
232 | 
233 | 
234 | 
235 | 
236 | ## 结语
237 | 
238 | 有几个开发的注意事项。
239 | 
240 | * 声明变量不要给初始值。
241 | * 入口函数在第一个。否则oep会在shellcode中间。
242 | * 存api函数地址不能使用全局变量，可以定义一个结构体来存放。
243 | * MyGetProcAddress 由于要解析pe头，所以32位和64位不通用。
244 | * strcmp、memcpy这种函数得自己实现， 可以去vc++6.0 里面拷贝。
245 | 
246 | 生成完shellcode之后吧可执行文件丢到x64dbg里面去，f9运行到OEP往下翻一下，看看地址下面有没有横线。
247 | 
248 | 出现横线就代表代码中出现了绝对地址的变量。
249 | 
250 | 右键在内存窗口中转到，结合pdb符号文件找出哪个函数中出现的绝对地址。
251 | 
252 | 
253 | 
254 | ## 特别鸣谢：
255 | 
256 | wangda:https://github.com/wangda38
257 | 
258 | 此项目参照好兄弟提供的upx壳代码shellcode部分二开。
259 | 
260 | 


--------------------------------------------------------------------------------
/ShellCode32/ShellCode32.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{3e3f5f91-09ae-46ba-967c-c518b71715a9}</ProjectGuid>
 25 |     <RootNamespace>ShellCode32</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v142</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v142</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v142</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v142</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <LinkIncremental>true</LinkIncremental>
 75 |   </PropertyGroup>
 76 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 77 |     <LinkIncremental>false</LinkIncremental>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 80 |     <LinkIncremental>true</LinkIncremental>
 81 |   </PropertyGroup>
 82 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 83 |     <LinkIncremental>false</LinkIncremental>
 84 |   </PropertyGroup>
 85 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 86 |     <ClCompile>
 87 |       <WarningLevel>Level3</WarningLevel>
 88 |       <SDLCheck>true</SDLCheck>
 89 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 90 |       <ConformanceMode>true</ConformanceMode>
 91 |     </ClCompile>
 92 |     <Link>
 93 |       <SubSystem>Console</SubSystem>
 94 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 95 |     </Link>
 96 |   </ItemDefinitionGroup>
 97 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 98 |     <ClCompile>
 99 |       <WarningLevel>Level3</WarningLevel>
100 |       <FunctionLevelLinking>true</FunctionLevelLinking>
101 |       <IntrinsicFunctions>true</IntrinsicFunctions>
102 |       <SDLCheck>true</SDLCheck>
103 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
104 |       <ConformanceMode>true</ConformanceMode>
105 |       <Optimization>Disabled</Optimization>
106 |       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
107 |       <BufferSecurityCheck>false</BufferSecurityCheck>
108 |     </ClCompile>
109 |     <Link>
110 |       <SubSystem>Console</SubSystem>
111 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
112 |       <OptimizeReferences>true</OptimizeReferences>
113 |       <GenerateDebugInformation>true</GenerateDebugInformation>
114 |       <EntryPointSymbol>ShellCodeOEP</EntryPointSymbol>
115 |     </Link>
116 |   </ItemDefinitionGroup>
117 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
118 |     <ClCompile>
119 |       <WarningLevel>Level3</WarningLevel>
120 |       <SDLCheck>true</SDLCheck>
121 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
122 |       <ConformanceMode>true</ConformanceMode>
123 |     </ClCompile>
124 |     <Link>
125 |       <SubSystem>Console</SubSystem>
126 |       <GenerateDebugInformation>true</GenerateDebugInformation>
127 |     </Link>
128 |   </ItemDefinitionGroup>
129 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
130 |     <ClCompile>
131 |       <WarningLevel>Level3</WarningLevel>
132 |       <FunctionLevelLinking>true</FunctionLevelLinking>
133 |       <IntrinsicFunctions>true</IntrinsicFunctions>
134 |       <SDLCheck>true</SDLCheck>
135 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
136 |       <ConformanceMode>true</ConformanceMode>
137 |       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
138 |       <BufferSecurityCheck>false</BufferSecurityCheck>
139 |     </ClCompile>
140 |     <Link>
141 |       <SubSystem>Console</SubSystem>
142 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
143 |       <OptimizeReferences>true</OptimizeReferences>
144 |       <GenerateDebugInformation>true</GenerateDebugInformation>
145 |       <EntryPointSymbol>ShellCodeOEP</EntryPointSymbol>
146 |     </Link>
147 |   </ItemDefinitionGroup>
148 |   <ItemGroup>
149 |     <ClCompile Include="ShellCode32.cpp" />
150 |   </ItemGroup>
151 |   <ItemGroup>
152 |     <ClInclude Include="shellcode.h" />
153 |   </ItemGroup>
154 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
155 |   <ImportGroup Label="ExtensionTargets">
156 |   </ImportGroup>
157 | </Project>


--------------------------------------------------------------------------------
/shellcode64/shellcode64.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{89ea323e-821a-4c99-97eb-80a5de65f2ab}</ProjectGuid>
 25 |     <RootNamespace>shellcode64</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v142</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v142</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v142</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v142</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |     <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
 58 |   </ImportGroup>
 59 |   <ImportGroup Label="Shared">
 60 |   </ImportGroup>
 61 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 62 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 63 |   </ImportGroup>
 64 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 65 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 66 |   </ImportGroup>
 67 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 68 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 69 |   </ImportGroup>
 70 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 71 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 72 |   </ImportGroup>
 73 |   <PropertyGroup Label="UserMacros" />
 74 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 75 |     <LinkIncremental>true</LinkIncremental>
 76 |   </PropertyGroup>
 77 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 78 |     <LinkIncremental>false</LinkIncremental>
 79 |   </PropertyGroup>
 80 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 81 |     <LinkIncremental>true</LinkIncremental>
 82 |   </PropertyGroup>
 83 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 84 |     <LinkIncremental>false</LinkIncremental>
 85 |   </PropertyGroup>
 86 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 87 |     <ClCompile>
 88 |       <WarningLevel>Level3</WarningLevel>
 89 |       <SDLCheck>true</SDLCheck>
 90 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 91 |       <ConformanceMode>true</ConformanceMode>
 92 |     </ClCompile>
 93 |     <Link>
 94 |       <SubSystem>Console</SubSystem>
 95 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 96 |     </Link>
 97 |   </ItemDefinitionGroup>
 98 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 99 |     <ClCompile>
100 |       <WarningLevel>Level3</WarningLevel>
101 |       <FunctionLevelLinking>true</FunctionLevelLinking>
102 |       <IntrinsicFunctions>true</IntrinsicFunctions>
103 |       <SDLCheck>true</SDLCheck>
104 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
105 |       <ConformanceMode>true</ConformanceMode>
106 |     </ClCompile>
107 |     <Link>
108 |       <SubSystem>Console</SubSystem>
109 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
110 |       <OptimizeReferences>true</OptimizeReferences>
111 |       <GenerateDebugInformation>true</GenerateDebugInformation>
112 |     </Link>
113 |   </ItemDefinitionGroup>
114 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
115 |     <ClCompile>
116 |       <WarningLevel>Level3</WarningLevel>
117 |       <SDLCheck>true</SDLCheck>
118 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
119 |       <ConformanceMode>true</ConformanceMode>
120 |     </ClCompile>
121 |     <Link>
122 |       <SubSystem>Console</SubSystem>
123 |       <GenerateDebugInformation>true</GenerateDebugInformation>
124 |     </Link>
125 |   </ItemDefinitionGroup>
126 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
127 |     <ClCompile>
128 |       <WarningLevel>Level3</WarningLevel>
129 |       <FunctionLevelLinking>true</FunctionLevelLinking>
130 |       <IntrinsicFunctions>true</IntrinsicFunctions>
131 |       <SDLCheck>true</SDLCheck>
132 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
133 |       <ConformanceMode>true</ConformanceMode>
134 |       <BufferSecurityCheck>false</BufferSecurityCheck>
135 |       <Optimization>Disabled</Optimization>
136 |       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
137 |     </ClCompile>
138 |     <Link>
139 |       <SubSystem>Console</SubSystem>
140 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
141 |       <OptimizeReferences>true</OptimizeReferences>
142 |       <GenerateDebugInformation>true</GenerateDebugInformation>
143 |       <EntryPointSymbol>ShellCodeEntry</EntryPointSymbol>
144 |     </Link>
145 |   </ItemDefinitionGroup>
146 |   <ItemGroup>
147 |     <ClCompile Include="shellcode64.cpp" />
148 |   </ItemGroup>
149 |   <ItemGroup>
150 |     <MASM Include="GetModule.asm">
151 |       <FileType>Document</FileType>
152 |       <ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</ExcludedFromBuild>
153 |     </MASM>
154 |   </ItemGroup>
155 |   <ItemGroup>
156 |     <ClInclude Include="shellcode64.h" />
157 |   </ItemGroup>
158 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
159 |   <ImportGroup Label="ExtensionTargets">
160 |     <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
161 |   </ImportGroup>
162 | </Project>


--------------------------------------------------------------------------------