offensive-shellcode

1## Shellcode Development Workflow
2 
31. Define concept and target platform (x86/x64, Windows/Linux/macOS)
42. Write assembly using position-independent techniques
53. Extract binary and test in controlled environment
64. Apply null byte avoidance and optimizations
75. Encode/encrypt to evade static detection
86. Package with loader and choose delivery method
9 
10---
11 
12## Basic Concepts
13 
14### Execution Pattern (Allocate-Write-Execute)
15 
16Avoid direct `PAGE_EXECUTE_READWRITE` — prefer:
171. Allocate with `PAGE_READWRITE`
182. Write shellcode to allocated region
193. Call `VirtualProtect` to switch to `PAGE_EXECUTE_READ`
20 
21```c
22char *dest = VirtualAlloc(NULL, 0x1234, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
23memcpy(dest, shellcode, 0x1234);
24VirtualProtect(dest, 0x1234, PAGE_EXECUTE_READ, &old);
25((void(*)())dest)();
26```
27 
28### Position-Independent Code (PIC) Techniques
29 
30| Method | Platform | Notes |
31|--------|----------|-------|
32| Call/Pop | Windows | Push next addr, pop into register |
33| FPU state | Windows | `fstenv` saves instruction pointer |
34| SEH | Windows | Exception handler stores EIP |
35| GOT | Linux | Global Offset Table |
36| VDSO | Linux | Kernel-provided shared object |
37 
38---
39 
40## Windows API Resolution (PEB Walk)
41 
42Identifying `kernel32.dll` without imports:
43 
441. Get `PEB` via `gs:[0x60]` (x64) or `fs:[0x30]` (x86)
452. Walk `PEB->Ldr.InMemoryOrderModuleList` — order: exe → ntdll → kernel32
463. Hash-compare module names to locate `kernel32`
474. Parse the Export Address Table (EAT)
48…