Tag Info

It is perfectly valid to write shellcode in any language that gets compiled down to machine code instructions. Provided no external libraries that are not linked by the victim program are required for its operation. However, it is almost never the case that directly compiled code (even from just C) is a valid, injectable shellcode. The most common reason ...

The Linux kernel can be viewed as a kind of ultimate shell code, since it is "injected" on a raw machine (which only has the BIOS code at that point) and then provides a lot of functionality. That kernel is written in C. If you write shell code in C or C++, you will run into trouble with library calls and linking, which are two facets of the same issue. ...

First of all, the paper you are reading is more than a decade old and is no longer applicable to modern systems. The problem you are facing is that in the latest version of GCC, the main no longer "returns" like a normal function, its just exits. If you want a pointer to the return address int *ret; then you need to declare another function, and call ...

You're very much getting into the realm of "Here be dragons" when you look into hardware manipulation like this. I don't know of any research or in-the-wild attack that has done any practical experimentation with this, so my answer will be purely academic. First, it's probably best if I explain a bit about how microcode works. If you're already clued up on ...

Although modern x86 processors allow for runtime microcode upload, the format is model-specific, undocumented, and controlled by checksums and possibly signatures. Also, the scope of microcode is somewhat limited nowadays, because most instructions are hardwired. See this answer for some details. Modern operating systems upload microcode blocks upon boot, ...

Since shellcode is just a raw block of instructions, these tools aren't really suited. Wat? Executables are just raw blocks of instructions too! No really. Ok, maybe there's bits of data in there for PE/ELF headers or the like, or just plain program data, but the data is the same binary as instructions. To the point sections of executables are labelled ...

I don't think that changing the microcode of x86 is possible but running an emulator on top with different microcode is possible and being used. This emulator can be built to start at boot time similar to CPU bootstrapping (yes, CPUs need to bootstrap too). Obfuscating opcodes is being used in PE protectors which will generate an unique set of opcodes and ...

There's a good way to solve problems (2) and (3) in the described manual binding process but I'm reluctant to publish good and elaborated public tutorial about designing shellcode here on StackExchange. ^_^ So, there's a hint for you of using crcs for (2) and indirect calls for (3) - you seem familiar enough with the manual binding process to deduce the ...

you can use scdbg with the raw binary shellcode file to get a runtime log of all of the api it uses. Execution is done in the libemu emulation envirnoment. The -d option will create a dump of the memory once finished if it detects any memory modifications (self decoding). The tool also supports locating shellcode start offsets (in case of ROP prefix), and an ...