Add ROP chains for Office 2007 and Office 2010 (hxds.dll)

This adds two ROP chains for Office 2007 and Office 2010 based on hxds.dll.

I don't really have a pretty way to test them, except for doing a real spray in memory, and then manually playing with it with a debugger.

First I start with this test script:
https://gist.github.com/wchen-r7/6774619

And then I do these:

- [ ] Start IE (in my case I run IE9 on Win 7 SP1)
- [ ] Attach debugger to IE (I use ImmDBG in this case)
- [ ] Start msfconsole and run the test module
- [ ] In the browser, go to the link provided by the module. This should spray the ROPs in memory.
- [ ] Pause the debugger.
- [ ] If you're using Office 2007, modify ESP to 0x20302020. If 2010, modify to 0x203020DC.
- [ ] Modify EIP to some RET instruction that's executable. The RET should point to the first gadget of the ROP.
- [ ] Step through the ROP chain. Make sure you're executing VirtualProtect with success (EAX=0), and that it returns to a bunch of 0x90s as the fake payload.  The 0x90s should be executable too.

For your reference, in Office 2007, the VirtualProtect should have these arguments:

	20302044   FFFFFFFF  ÿÿÿÿ  |hProcess = FFFFFFFF
	20302048   20302074  t 0   |Address = 20302074
	2030204C   00000201  ..  |Size = 201 (513.)
	20302050   00000040  @...  |NewProtect = PAGE_EXECUTE_READWRITE

In Office 2010, the arguments would look like:

	20302108   FFFFFFFF  ÿÿÿÿ  |hProcess = FFFFFFFF
	2030210C   20302138  8!0   |Address = 20302138
	20302110   00000201  ..  |Size = 201 (513.)
	20302114   00000040  @...  |NewProtect = PAGE_EXECUTE_READWRITE
	20302118   51C5C638  8ÆÅQ  \pOldProtect = hxds.51C5C638