CPP

/*
SCT.cpp
Elias Augusto 3/26/2019
A simple SH3 shellcode tester created for the HP Jornada 680/690 running Windows CE 2.11
Part of an ongoing series on exploit development, find it on my medium:

Will execute 101 bytes of shellcode and push 303 bytes onto the heap in their own little chunks
Currently all it does is nop 50 times and exit, but eventually will test a custom made omlette egghunter
In the meantime, feel free to use this if you're interested
*/
#include "stdafx.h"
unsigned char mainsc[]="\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61";

unsigned char scptone[]="\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61";

unsigned char scpttwo[]="\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                        "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61";

unsigned char scptthree[]="\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61"
                            "\x13\x61\x13\x61\x13\x61\x13\x61\x13\x61";

int sconheap(){
    //unsigned chars required to be same length, don't need to null terminate
    unsigned char *scone = (unsigned char *) malloc((sizeof(scptone)/sizeof(scptone[0])));
    unsigned char *sctwo = (unsigned char *) malloc((sizeof(scpttwo)/sizeof(scpttwo[0])));
    unsigned char *scthree = (unsigned char *) malloc((sizeof(scptthree)/sizeof(scptthree[0])));
    memcpy(scone, scptone, (sizeof(scptthree)/sizeof(scptthree[0])));
    memcpy(sctwo, scpttwo, (sizeof(scptthree)/sizeof(scptthree[0])));
    memcpy(scthree, scptthree, (sizeof(scptthree)/sizeof(scptthree[0])));
    return (0);
}

int WINAPI WinMain( HINSTANCE hInstance,
                    HINSTANCE hPrevInstance,
                    LPTSTR    lpCmdLine,
                    int       nCmdShow)
{
    int tester = sconheap();
    int (*func)() = (int(*)())&mainsc;
    func();
    return 0;
}