analyzing-position-independent-code
starsforks
How to install analyzing-position-independent-code?
meltedinhex/analyst-ai-pack/analyzing-position-independent-code
$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-position-independent-codeAnalyzes position-independent code and shellcode by identifying GetPC/PEB-walk
SKILL.md
| 1 | # Analyzing Position-Independent Code |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have a PIC blob/shellcode that resolves its own addresses and APIs without imports, and you |
| 6 | need to understand its technique before disassembly. |
| 7 | - You want to identify the base-resolution (GetPC), PEB-walk, and API-hashing mechanics. |
| 8 | |
| 9 | **Do not use** this to execute the code — analyze it statically (and emulate separately if needed). |
| 10 | Treat the blob as malicious. |
| 11 | |
| 12 | ## Prerequisites |
| 13 | |
| 14 | - The PIC/shellcode blob (read inertly). |
| 15 | |
| 16 | ## Safety & Handling |
| 17 | |
| 18 | - Read bytes statically; store the blob password-protected and never execute it. |
| 19 | |
| 20 | ## Workflow |
| 21 | |
| 22 | ### Step 1: Identify PIC techniques |
| 23 | |
| 24 | ```bash |
| 25 | python scripts/analyst.py analyze shellcode.bin |
| 26 | ``` |
| 27 | |
| 28 | Detects GetPC stubs (`call $+5`/`fnstenv`), PEB access (`fs:[30]`/`gs:[60]`), API-hash loops |
| 29 | (`lodsb` + `ror`), and stack-string construction. |
| 30 | |
| 31 | ### Step 2: Determine architecture and base behavior |
| 32 | |
| 33 | Confirm 32- vs 64-bit PEB access and how the code computes its own base for relative addressing. |
| 34 | |
| 35 | ### Step 3: Map API resolution |
| 36 | |
| 37 | Note the hashing algorithm and that resolved APIs are obtained by walking the PEB→LDR→export tables |
| 38 | (pair with the API-hash resolver skill). |
| 39 | |
| 40 | ### Step 4: Disassemble at the right base |
| 41 | |
| 42 | Load the blob at the inferred base/entry in a disassembler/emulator and proceed. |
| 43 | |
| 44 | ## Validation |
| 45 | |
| 46 | - PIC technique hits reference real patterns (GetPC/PEB/API-hash), not arbitrary bytes. |
| 47 | - Architecture is consistent with the PEB-access form detected. |
| 48 | - The analysis points to a concrete entry/base for disassembly. |
| 49 | |
| 50 | ## Pitfalls |
| 51 | |
| 52 | - Encoded/staged shellcode where the PIC patterns appear only after decoding. |
| 53 | - Mixed 32/64-bit (WoW64) transitions. |
| 54 | - Custom GetPC variants not matching common signatures. |
| 55 | |
| 56 | ## References |
| 57 | |
| 58 | - See [`references/api-reference.md`](references/api-reference.md) for the analyzer. |
| 59 | - PEB/LDR and ATT&CK T1027.007 references (linked in frontmatter). |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
