Search code examples
c++arrayswindowscharshellcode

Load shellcode from file to char* comes strange characters in end of text

I have a char array[] and is like following:

// MessageBox
   char xcode[] = "\x31\xc9\x64\x8b\x41\x30\x8b\x40\xc\x8b\x70\x14\xad\x96\xad\x8b\x58\x10\x8b\x53\x3c\x1\xda\x8b\x52\x78\x1\xda\x8b\x72\x20\x1\xde\x31\xc9\x41\xad\x1\xd8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x4\x72\x6f\x63\x41\x75\xeb\x81\x78\x8\x64\x64\x72\x65\x75\xe2\x8b\x72\x24\x1\xde\x66\x8b\xc\x4e\x49\x8b\x72\x1c\x1\xde\x8b\x14\x8e\x1\xda\x31\xc9\x53\x52\x51\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x54\x53\xff\xd2\x83\xc4\xc\x59\x50\x51\x66\xb9\x6c\x6c\x51\x68\x33\x32\x2e\x64\x68\x75\x73\x65\x72\x54\xff\xd0\x83\xc4\x10\x8b\x54\x24\x4\xb9\x6f\x78\x41\x0\x51\x68\x61\x67\x65\x42\x68\x4d\x65\x73\x73\x54\x50\xff\xd2\x83\xc4\x10\x68\x61\x62\x63\x64\x83\x6c\x24\x3\x64\x89\xe6\x31\xc9\x51\x56\x56\x51\xff\xd0";

Then i had inserted all this content of variable above into a file (file with UTF-8 format and content without the "") and tried load this way:

    ifstream infile;

    infile.open("shellcode.bin", std::ios::in | std::ios::binary);
    infile.seekg(0, std::ios::end);

    size_t file_size_in_byte = infile.tellg();
    char* xcode = (char*)malloc(sizeof(char) * file_size_in_byte);

    infile.seekg(0, std::ios::beg);
    infile.read(xcode, file_size_in_byte);

    printf("%s\n", xcode); // << prints content of xcode after load from file

    if (infile.eof()) {
        size_t bytes_really_read = infile.gcount();
    }
    else if (infile.fail()) {
    }

    infile.close();

I'm seeing some strange characters in end of text see:

strange characters

What is need to fix it?

Solution

  • The issue is that the printf format specifier "%s" requires that the string is null-terminated. In your case, the null-terminator just happens to be after those characters you're seeing, but nothing guarantees where the null is unless you put one there.

    Since you're using C++, one way to print the characters is to use the write() function available for streams:

    #include <iostream>
//...
std::cout.write(xcode, file_size_in_bytes);

    The overall point is this -- if you have a character array that is not null-terminated and contains data, you must either:

    1. Put the null in the right place before using the array in functions that look for the null-terminator or
    2. Use functions that state how many characters to process from the character array.

    The answer above uses item 2.