What is Shellcode? and how to creat it?

[fasfaFasds (ASDadaDa)]

Hello my friends, I’m starting to write malware. Currently, I’m testing the Process Hollowing technique, so I need a payload to write into the process memory.

So… Shellcode is the hexadecimal representation of the assembly instructions?
Exemple of a payload (Python):
payload = (b"\xdb\xc3\xd9\x74\x24\xf4\xbe\xe8\x5a\x27\x13\x5f\x31\xc9\xb1\x33\x31/.....)

My question is how do I create this payload? Is it possible to transform a .exe file in this HEX format and then inject into another process? Or can I transform a python script into this HEX format?

Not gonna lie… I’m very confuse on how programmers create payloads in this HEX format… So any help is welcomed. Also, I apologize if this is a nooby question… But i could not find answers.

[0x00pf (pico)]

You can take a look to this

Programming for Wannabees. Part III. Your first Shell Code

Let’s go on with our special ASM/C programming course. At this point, we roughly know how a computer works, its main components, what is machine code, what is assembly code and how to compile simple programs for a few architectures. In this part we are going to write our first shellcode. Yes, we are that advanced. But, before we get there, we will be exploring a few more new concepts. Let’s start. Processor Native Word Size In this part we will start dealing with stuff bigger than 1 byte, and …

You may also want to read the two previous instalments if you have just started with it.

Otherwise take a look to this:

Linux Shellcoding (Part 1.0)

As promised, here is the shellcode tutorial once again Requirements Alright so this isn’t going to be msfvenom tutorial. (shellcodes are payloads). This tutorial will focus on writing shellcodes using Assembly. Knowledge of C and Assembly is highly recommend. Also knowing how the stack works is a big plus. Memory Segments When a program is run it is loaded in the RAM. Normally 5 segments are used in programs: The stack segment (For function calls (dynamic)). The heap segment (For dynamicly …

[fasfaFasds (ASDadaDa)]

Thanks for the amazing links.
My objective is not to write my own shellcode, but to inject an already existing .exe into memory.
So it appears I have to get the HEX values of the .text section of the PE file… I’m going to start working on this.
MsfVenom can create this payloads… but what i want is to create one for a custom exe… not their ready reverse tcp…

If anyone knows any good material on this topic, please post links. This is very cools concepts, but hard to find information

[0xf00]

@fasfaFasds

Shellcode is the hexadecimal representation of the assembly instructions?

Exploit Development 101

Introduction This article will describe how to develop exploits to target specific vulnerabilities, There are many challenges that you may face when writing malicious code to target specific vulnerabilities, I will go through several phases of exploit development and arrive at a working exploit. Overview When writing exploits, we often need to find overflows in programs. These bugs often occur in either buffer overflows or stack overflows, and when this happens we look for two things: our bu…

[dtm]

@fasfaFasds

Shellcode is the hexadecimal representation of the assembly instructions?

Shellcode is generally a sequence of instructions. Hex is a different way of representing a value. Take the following nop instruction as an example:

Instruction: nop
Hex: 90
Decimal: 144
Octal: 220
Binary: 10010000

The value of decimal 144 can be represented in different ways depending on the context. If you want its hex value, it is 0x90. If you want the instruction associated with hex 0x90, it is nop. These are just representations of the same thing. When dealing with low level values and instructions like this, hex is the most common and preferred representation.

@fasfaFasds

My question is how do I create this payload?

Creating the payload depends on what kind you want. If you want shellcode, it is usually written in assembly and assembled in the target architectural instruction set like x86 Intel, ARM, or MIPS. Alternatively, shellcode can be compiled from a higher level language like C or C++.

@fasfaFasds

Is it possible to transform a .exe file in this HEX format and then inject into another process? Or can I transform a python script into this HEX format?

A Windows PE file is an executable file format that is the result of assembled and linked assembly or the compilation of a higher level language. The values that make up the PE file can be (and usually is preferred to be) represented as hex. If you open a PE file in a hex editor, you can see its values represented as hex. Again, hex is just a representation of a value. Since PE files are a specific file format, you need to follow the rules of the file format so that it can run properly. Yes, you can inject it into another process but you need to inject it properly rather than just naively copying it.

@fasfaFasds

So it appears I have to get the HEX values of the .text section of the PE file… I’m going to start working on this.

This may or may not be correct. If you are attempting to just copy a typical PE file’s .text section into an external process and then execute it, it will not work because there are dependencies. Process hollowing doesn’t require much knowledge of PE file internals but you should know at least the basics to achieve it.

@fasfaFasds

Not gonna lie… I’m very confuse on how programmers create payloads in this HEX format

Now I’m going to be blunt. You’re confused because you severely lack the fundamental computer science knowledge that lets you do what you want to do. Understanding the definition of “hex” is computer science 101 so not even knowing that puts you right at the bottom. Take a step back and actually build up your basic knowledge.