Win32 Shellcoding Enviornment Setup

2 minute read

Enviornment Setup

Operating System

  • Windows XP Professional - 32-bit - Version 2002 - Service Pack 3


  • Immunity Debugger v1.85 - 32-bit
  • WinDbg 6.12.0002.633 x86 - Version 5.1 (Build 2600.xpsp.080413-2111: Service Pack 3)


Exploit tools

  • PuTTY 0.73 - 32-bit x86
    • Used to SSH to Host computer within the Windows XP VM
  • python 2.7.3 - 32-bit
    • Required for immunity Debugger Mona plugin
  • BETA 3 v1.1
  • arwin
    • Used to find addresses of functions (symbols) within DLL’s
    • Downloaded arwin.c source code, then compiled locally with MSVS C++ 2008 Express.
Arwin Source Code
#include <windows.h>
#include <stdio.h>
arwin - win32 address resolution program by steve hanna v.01
you are free to modify this code but please attribute me if you
change the code. bugfixes & additions are welcome please email me!
to compile:
you will need a win32 compiler with the win32 SDK
this program finds the absolute address of a function in a specified DLL.
happy shellcoding!
int main(int argc, char** argv)
        HMODULE hmod_libname;
        FARPROC fprc_func;
        printf("arwin - win32 address resolution program - by steve hanna - v.01\n");
        if(argc < 3)
                printf("%s <Library Name> <Function Name>\n",argv[0]);
        hmod_libname = LoadLibrary(argv[1]);
        if(hmod_libname == NULL)
                printf("Error: could not load library!\n");
        fprc_func = GetProcAddress(hmod_libname,argv[2]);
        if(fprc_func == NULL)
                printf("Error: could find the function in the library!\n");
        printf("%s is located at 0x%08x in %s\n",argv[2],(unsigned int)fprc_func,argv[1]);

Testing Win32 Shellcode

  • This program can be used to test windows 32-bit shellcode.
  • Use the lcc-win32 program to compile the shellcode.
    • Compiling with dev-cpp will launch 100+ failing processes of the program in an endless loop.
// Replace the NOP's with your shellcode
char code[] ="\x90\x90\x90\x90\x90\x90\x90\x90\x90"
int main(int argc, char **argv)
  int (*func)();
  func = (int(*)()) code;
  • Compile and then run the program to test out your shellcode.