Analyzing Shellcode

Shellcode is code with no container — no PE/ELF header, no imports table, no fixed load address — so it must find everything it needs at runtime. That self-reliance is exactly what gives it away: the PEB walk, the API hashing, the position-independent GetPC trick are structural fingerprints you can read even before you know what the payload does.

When to Use

• A raw blob of position-independent code with no PE/ELF/Mach-O header
• A payload carved from an exploit, a macro, a loader, or a JS/HTA dropper
• A \x-escaped, 0x-prefixed, base64, or XOR-obfuscated byte buffer
• A suspected Metasploit stager (reverse_tcp/https) or Cobalt Strike beacon stage
• An egg-hunter or GetPC/decoder stub found while triaging a larger binary
• Bytes recovered from network capture, RWX memory, or a document stream

When NOT to Use