Comments on: w32-exec-calc-shellcode released http://skypher.com/index.php/2010/01/17/w32-exec-calc-shellcode-released/ The blog for absolutely nothing! Wed, 02 May 2012 00:54:08 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: SkyLined http://skypher.com/index.php/2010/01/17/w32-exec-calc-shellcode-released/comment-page-1/#comment-1288 SkyLined Sun, 02 Jan 2011 15:50:34 +0000 http://skypher.com/?p=382#comment-1288 Yes, you are right; I used my hashing code from previous shellcode without considering if it is the best solution. Since I'm only making one API call, your solution to look for a function that starts with "WinE" is a lot smaller. Yes, you are right; I used my hashing code from previous shellcode without considering if it is the best solution. Since I’m only making one API call, your solution to look for a function that starts with “WinE” is a lot smaller.

]]> By: Peter Ferrie http://skypher.com/index.php/2010/01/17/w32-exec-calc-shellcode-released/comment-page-1/#comment-1280 Peter Ferrie Fri, 31 Dec 2010 23:33:47 +0000 http://skypher.com/?p=382#comment-1280 I have x86 all versions null-free in 67 bytes. Hashing uses too many bytes. I published a pre-7 version that pops cmd.exe. It's in the first shellcode presentation on <a href="http://pferrie.tripod.com" rel="nofollow">my site</a>. It's only a slight alteration to pop calc.exe instead, and Windows 7 compatibility requires only two additional bytes. That presentation also includes a size-optimised uppercase-only shellcode. Maybe you can find something there to interest you. I have x86 all versions null-free in 67 bytes.
Hashing uses too many bytes.

I published a pre-7 version that pops cmd.exe. It’s in the first
shellcode presentation on my site. It’s only a
slight alteration to pop calc.exe instead, and Windows 7 compatibility
requires only two additional bytes.
That presentation also includes a size-optimised uppercase-only shellcode.
Maybe you can find something there to interest you.

]]>