This question is related to crackmes.de's k1 by xtfusion. I'm trying to add custom shellcode through stack overflow.

The shellcode works perfect under Windows XP (without ASLR) when the program is attached in the debugger. But when I run the program with double click, the program only exits quietly and no message box pops up.

Full alphanumeric shellcode (and the screenshot above):

                     ; no need to LoadLibraryA manually
push eax             ; eax should be 0 now
push 0x646E7770      ; 'pwnd'
push esp
pop ecx              ; address of 'pwnd'
push esp
pop eax
push esp
pop edx              ; address of 'pwnd', backup for later use
sub eax,0x55555521
sub eax,0x55555421
sub eax,0x55555648
push eax
pop esp
push 0x7E
and eax,0x554E4D4A
and eax,0x2A313235
sub eax,0x55555555
sub eax,0x55555555
sub eax,0x334D556E   ; encode intruction e8070822
push eax             ; write to memory on the fly
push edx
pop esp
push esi             ; 0, esi should be 0 now
push ecx             ; address of string 'pwnd'
push esi             ; 0
push esi             ; 0
jne 0x22FFE6         ; jump to the generated instruction `call USER32.MessageBoxA`

I'm not quite familiar with Windows API.

What does the message box do when the program exits? Do I need to migrate the message box to another existed process?

Why the message box does not show up without the debugger?

Thanks in advance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.