offensive-shellcode

## Shellcode Development Workflow 1. Define concept and target platform (x86/x64, Windows/Linux/macOS) 2. Write assembly using position-independent techniques 3. Extract binary and test in controlled environment 4. Apply null byte avoidance and optimizations 5. Encode/encrypt to evade static detection 6. Package with loader and choose delivery method --- ## Basic Concepts ### Execution Pattern (Allocate-Write-Execute) Avoid direct `PAGE_EXECUTE_READWRITE` — prefer: 1. Allocate with `PAGE_READWRITE` 2. Write shellcode to allocated region 3. Call `VirtualProtect` to switch to `PAGE_EXECUTE_READ` ```c char *dest = VirtualAlloc(NULL, 0x1234, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE); memcpy(dest, shellcode, 0x1234); VirtualProtect(dest, 0x1234, PAGE_EXECUTE_READ, &old); ((void(*)())dest)(); ``` ### Position-Independent Code (PIC) Techniques | Method | Platform | Notes | |--------|----------|-------| | Call/Pop | Windows | Push next addr, pop into register | | FPU state | Windows | `fstenv` saves instruction pointer | | SEH | Windows | Exception handler stores EIP | | GOT | Linux | Global Offset Table | | VDSO | Linux | Kernel-provided shared object | --- ## Windows API Resolution (PEB Walk) Identifying `kernel32.dll` without imports: 1. Get `PEB` via `gs:[0x60]` (x64) or `fs:[0x30]` (x86) 2. Walk `PEB->Ldr.InMemoryOrderModuleList` — order: exe → ntdll → kernel32 3. Hash-compare module names to locate `kernel32` 4. Parse the Export Address Table (EAT) 5. Find `GetProcAdd...