Get started as a beginner![]
Most of the code cores for all cheap characters are executed by exploits, and these core codes are called shellcodes. They are similar to DLL (Dynamic Link Library): they essentially execute binary assembly code, executable files (.exe) are also the same, but it has an EPROCESS structure (Windows OS).
If we want to write shellcodes, we must first download one of these software:
1. NASM
NASM supports 16, 32, and 64-bit assembly programming, and can generate shellcode (.bin files) without code linking. They are often standalone and need to be included in exploits or threads to execute.
2. MASM (Not recommended)
MASM is mostly used for internal assembly in C language programming, but we do not recommend using it to generate shellcode separately because its syntax is very cumbersome in the beginner stage. It's recommended to cooperate with MSVC for shellcode generation.
defuse.ca (website)
3. Online assembly tool in defuse.ca.
If you don't want to download any software to create your own shellcode, we recommend you use defuse.ca.
4. MSVC in VisualStudio
Visual Studio (VS) is generally used for modern application programming, but under specific code rules, it can be used to write shellcodes, such as converters. This is a good choice in some complex code writing, such as the famous github project sRDI, where the function of loading the DLL's import table is converted to shellcode. sRDI extracts the. text section from the. dll file through a Windows power shell script combined with the map file generated by VS and generates a shell code. Visual Studio usually needs to be purchased, so we recommend to download the Community version since it's free.
In addition, in complex code writing, VS's advanced debugger can help you a lot, which will be explained in the future.
There are many other methods to do this but it doesn't matter what the method is, as long as you know it, that is your key!
_____________________________________________________________________
Once you have downloaded or chosen your method for creating your shellcodes and, having generated it, we need a hexadecimal editor to copy and paste our shellcode.
Regular text editors copy, paste, or save bytes that are coerced to a char type instead of unsigned char, char can only represent decimal values ranging from -127 to 127, while unsigned char can represent decimal values ranging from 255. This results in some values being changed after the operation. We recommend the following hexadecimal editors:
Sakura Editor
1. Sakura Editor
It's not possible to edit single or multiple hexadecimal data in detail, but when it copies text, it will copy each character as an unsigned char, and these unsigned bytes can also be saved when saving the file. It's a beloved choice of the Eastern MUGEN community!
2. HxD
HxD
HxD is a fast hex editor which is easy to use and offers features such as searching and replacing, exporting, modifing hex bytes and much more. You can also see your raw shellcode at the right side. In the left side, on the other hand, the shellcode's hexadecimal values.
3. C32ASM
Although it has ASM (Assembly) on its name, its assembly performance is not good. On the contrary, it has good hexadecimal file editing ability. However, when using the copy and paste function on systems above Windows 7, errors may be reported. If your OS is above than Windows 7, please be careful.
010 Editor
4. 010 Editor
This editor not only allows for copying and pasting the properties of hexadecimal files, but also allows for detailed editing of each hexadecimal value. However, it requires purchase before use. If you do not need commercial use, download a crack version.
We also need a memory reading and debugging software to help us view memory.
x64dbg/x32dbg
We recommend using the Cheat Engine, which is easy to understand and has its own debugger that can set breakpoints and modify memory values. OllyDbg and WinDbg appear very professional, but many functions are not as good as the Cheat Engine, because professional software workers (unless they are security software writers) do not need the "game cheating" feature.
Another very powerful debugger is x32dbg, but the UI is a bit too confusing at first. But if you get the hang of it, it's really useful. (The program is called x64dbg, but once you download it you will see that it will also include the 32-bit version of it, x32dbg.)
Environmental construction[]
We recommend using NASM for general assembly language writing, and the assembly language syntax in most tutorials is generally based on NASM standards.
So, if you want to use NASM, please click on the name of NASM in the "Get started as a beginner!" section (purple text), which will enter the official website of NASM and choose a "stable" version to download. If you are too lazy to go to the official website, you can directly use the following link:
32-bit stable version: Download 64-bit stable version: Download
If you want to use MASM, you only need to download Visual Studio (not Visual Studio Code), as it's included.
After completing the construction, you can proceed to the next step.
Information provided by Sak.