Shellcode is most commonly discussed in the context of software exploitation, but it’s also extremely useful for malware. Normal applications are typically compiled into executables, which contain multiple discrete ‘segments’ or ‘sections’. The executable expects each section to be loaded into memory at a specific address, or a specific distance from the previous section. As such, trying to move any code within the executable will usually result in the entire processes crashing.
On the other hand, shellcode is designed to be self-contained and work regardless of whatever memory address it’s loaded at. This means shellcode can easily be moved around in memory, and even copied into the memory of other processes (known as code injection).
Shellcode can also be encrypted when not in use, prevent anti-malware products from scanning it for known malicious signatures. When the code is needed it can be decrypted, copied into executable memory, then run.
These challenges serve as an introduction to working with malware which utilizes shellcode to conceal functionality. While you may not need to fully reverse all the shellcode to extract the flag, it’s always good to be able to explain what the shellcode does and why.
[Read more]