#include <stdio.h>
#include <stdlib.h>

#define MAX_BUFFER 150

/*A function pointer for executing shellcode*/
void (*shell_code_execute)(void);

/*A buffer for input shellcode*/
char buffer[MAX_BUFFER];

int main(int argc, char **argv)
{
  FILE *f;
  unsigned int col,byte;
  int *ret;
  char *ptrbuff;
  
  /*The number of argument must be 1 or 2*/
  if(argc > 3 || argc ==1)
    {
      printf("Usage: bct filename [exec]\n");
      return 1;
    }

  /*Open a file for reading*/
  if((f=fopen(argv[1],"r"))==NULL)
    {
      printf("Error! File not found!\n");
      return -1;
    }

  printf("----------\n");
  printf("Printing your code\n");
  printf("----------\n");

  printf("buffer[]=\n");
  col = 0;

  /*Repeat reading each byte from opened file until reaching end of file
   With each byte, print and put it in buffer*/

  ptrbuff = (char*)&buffer; //pointer to buffer
  while((byte=fgetc(f))!=EOF)
    {
      if(col==0) printf("\""); 
      printf("\\x%.2x",(unsigned char)byte);
      *(ptrbuff++)=(unsigned char)byte;
      col++;
      if(col==10) //print a new line after printing 10 bytes
	{
	  col=0;
	  printf("\"\n");
	}
    }
  printf("\";\n");
  fclose(f);

  /*Execute the code has been read. We get address of buffer and call
   the shellcode in buffer by using function pointer shell_code_execute*/
  if(argc==3 && strcmp(argv[2],"exec")==0)
    {
      
      printf("------------\n");
      printf("Executing your code!\n");
      printf("------------\n");

      shell_code_execute = (void(*)(void))buffer;
      (*shell_code_execute)();
    }

  return 0;
}

jmp short string
code:
  pop ecx       
  mov ebx, 1    
  mov edx, 14   
  mov eax, 4    
  int 80h
  mov ebx, 0    
  mov eax, 1
  int 80h
string:
  call code
  db "Hello, World!", 00h

nasm hello.asm -o hello

Tal@vxer:~/Documents/Research$ ./bct hello
----------
Printing your code
----------
buffer[]=
"\xeb\x24\x66\x59\x66\xbb\x01\x00\x00\x00"
"\x66\xba\x0e\x00\x00\x00\x66\xb8\x04\x00"
"\x00\x00\xcd\x80\x66\xbb\x00\x00\x00\x00"
"\x66\xb8\x01\x00\x00\x00\xcd\x80\xe8\xd9"
"\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f"
"\x72\x6c\x64\x21\x0a";

gcc -o bct bct.c

USE32                 ;directive này nói cho ta biết ta dịch ra mã 32 bits
  jmp short string
code:
  pop ecx
  mov ebx, 1    		
  mov edx, 14   
  mov eax, 4    
  int 80h
  mov ebx, 0    
  mov eax, 1
  int 80h
string:
  call code
  db "Hello, World!", 00h

Breakpoint 1, main (argc=3, argv=0xbffff9f4) at bct.c:69
69	      shell_code_execute = (void(*)(void))buffer;
(gdb) n
70	      (*shell_code_execute)();
(gdb) disas shell_code_execute 
Dump of assembler code for function buffer:
0x08049920 <buffer+0>:	jmp    0x8049946 <buffer+38>
0x08049922 <buffer+2>:	pop    %cx
0x08049924 <buffer+4>:	mov    $0x1,%bx
0x08049928 <buffer+8>:	add    %al,(%eax)
0x0804992a <buffer+10>:	mov    $0xe,%dx
0x0804992e <buffer+14>:	add    %al,(%eax)
0x08049930 <buffer+16>:	mov    $0x4,%ax
0x08049934 <buffer+20>:	add    %al,(%eax)
0x08049936 <buffer+22>:	int    $0x80
0x08049938 <buffer+24>:	mov    $0x0,%bx
0x0804993c <buffer+28>:	add    %al,(%eax)
0x0804993e <buffer+30>:	mov    $0x1,%ax
0x08049942 <buffer+34>:	add    %al,(%eax)
0x08049944 <buffer+36>:	int    $0x80
0x08049946 <buffer+38>:	call   0x6d4d9924
0x0804994b <buffer+43>:	insb   (%dx),%es:(%edi)
0x0804994c <buffer+44>:	insb   (%dx),%es:(%edi)
0x0804994d <buffer+45>:	outsl  %ds:(%esi),(%dx)
0x0804994e <buffer+46>:	sub    $0x20,%al
0x08049950 <buffer+48>:	push   %edi
0x08049951 <buffer+49>:	outsl  %ds:(%esi),(%dx)
0x08049952 <buffer+50>:	jb     0x80499c0

0x08049946 <buffer+38>:	call   0x6d4d9924