analyzing-shellcode

Analyzing Shellcode

Shellcode is code with no container — no PE/ELF header, no imports table, no fixed load address — so it must find everything it needs at runtime. That self-reliance is exactly what gives it away: the PEB walk, the API hashing, the position-independent GetPC trick are structural fingerprints you can read even before you know what the payload does.

When to Use

• A raw blob of position-independent code with no PE/ELF/Mach-O header
• A payload carved from an exploit, a macro, a loader, or a JS/HTA dropper
• A \x-escaped, 0x-prefixed, base64, or XOR-obfuscated byte buffer
• A suspected Metasploit stager (reverse_tcp/https) or Cobalt Strike beacon stage
• An egg-hunter or GetPC/decoder stub found while triaging a larger binary
• Bytes recovered from network capture, RWX memory, or a document stream

When NOT to Use

• The sample is a normal PE/ELF/Mach-O with headers — use analyzing-binaries for the loader-backed disassembly workflow
• You need broader sample triage or family ID — use analyzing-malware; come here only for the raw payload stage inside it
• The blob is a packed executable, not raw shellcode — use unpacking-protected-binaries to unwrap it first
• You are carving the shellcode out of a memory dump first — use analyzing-memory-images to locate and extract the region, then return here
• Deep static reversing once decoded — reverse-engineering is not a skill; route sustained disassembly work back to analyzing-binaries

Get the Bytes First

Shellcode arrives wrapped. Normalize it to a flat binary before anything else.

# \x-escaped or 0x C-array pasted from an exploit → raw bytes
python3 -c "import sys,re; d=open('sc.txt').read(); \
  b=bytes(int(x,16) for x in re.findall(r'(?:0x|\\\\x)([0-9a-fA-F]{2})',d)); \
  open('sc.bin','wb').write(b); sys.stderr.write(f'{len(b)} bytes\n')"

# base64 buffer
base64 -d payload.b64 > sc.bin

# single-byte XOR brute (find the key that yields printable / low entropy)
python3 -c "import sys; d=open('sc.bin','rb').read(); \
  [print(k, bytes(c^k for c in d[:16]).hex()) for k in range(256)]"