Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is the hex code at the top of this source file the same as the assembly at the bottom, as in they do the same thing?
How can I convert assembly into hex like in this source code file? I frequently see it being used in payloads. I understand it is done to preserve space, bypass IDS among other reasons.
Yes, they are the same thing.
To be more technical, the hex code at the top is "machine code" and what you see at the bottom is a human-readable representation of the machine code which you know to be called "assembly code". The machine code format isn't there to hide the payload - it is the payload. It is literally the the 1s and 0s that a computer would process to run this shellcode. It is just written as hex for convenience.
A shellcode author would typically write the shellcode in assembly and assemble it into machine code using an assembler program like nasm on linux. Although assembly code corresponds to machine code directly (more or less), your computer's processor only runs machine code.
If you want to learn more about using shellcode I recommend Hacking the Art of Exploitation as a good place to start.
There are encoders that can be used to obfuscate shellcode. Many are included in the Metasploit suite. A popular one is Shikata Ga Nai.
char shellcode[] = { 0b11101011, 0b00001101, 0b01011111, 0b00000000}; with each 8-bit chunk separated by a comma and starting with 0b to designate it as binary. Also make sure to end with a byte (8 bits) of all 0s (0b00000000) to indicate to the C compiler that it is the end of the string of bytes.
Nov 6, 2019 at 17:21
This is to add on to chillisauce.
I frequently see it being used in payloads. I understand it is done to preserve space, bypass IDS among other reasons.
Shellcodes are normally written in hex and then when executed, they get decoded. They're not written like that for any of the reasons you mentioned though. Shellcode is often injected into the application during runtime, so it can't be written in some high level language bceause there's nothing to compile or interpret this code. When working with shellcode, we're working at lower levels in the application stack -- we're working with assembly, registers and what not.
Payloads are often encoded, which is probably what you were referring to. Encoding is done for many reasons - to remove bad characters that would hamper execution of the shellcode, creating signatures that would bypass AVs and a few others. You also have packers and cryptors which help in hiding malicious code. As mentioned, Shikata Ga Nai is a commonly known encoder which can be used to encode your payload. But then again, commonly known means it can't bypass most AVs, and can handle only certain sequences of bad characters, which is why experts often resort to writing their own encoders.
Converting assembly into Hex? nasm shell is your friend. Kali linux comes with this inbuilt. More specifically, I think it comes along with the metasploit framework. Nasm can help you do this
nasm> push eax
50 push eax
nasm> push eax ; retn 4
50 push eax
C20400 ret 0x4
