Hacking/Shellcode/Alphanumeric/ALPHA3/x86/ASCII/Mixedcase/Decoder

From Skypher

▼Main Page ├─▷Programming └─▼Hacking   ├─▼Shellcode   │ ├─▷Bind   │ ├─○Restricted instruction set   │ ├─▼Alphanumeric   │ │ ├─○ALPHA2   │ │ ├─▼ALPHA3   │ │ │ ├─▼x86   │ │ │ │ ├─▼ASCII   │ │ │ │ │ ├─▷Lowercase   │ │ │ │ │ ├─▼Mixedcase   │ │ │ │ │ │ ├─▼Decoder   │ │ │ │ │ │ │ ├─○[EAX]   │ │ │ │ │ │ │ ├─○[EBX]   │ │ │ │ │ │ │ ├─○[ECX]   │ │ │ │ │ │ │ ├─○[EDX]   │ │ │ │ │ │ │ ├─○[ESI]   │ │ │ │ │ │ │ ├─○[EDI]   │ │ │ │ │ │ │ ├─○[ESP]   │ │ │ │ │ │ │ └─...   │ │ │ │ │ │ └─▷SEH GetPC (XP sp3)   │ │ │ │ │ └─▷Uppercase   │ │ │ │ └─▷Unicode   │ │ │ └─▷x64   │ │ ├─○IMUL 0x30 encoding   │ │ ├─○x86 printable opcodes   │ │ ├─○x86 printable operands   │ │ ├─○x64 printable opcodes   │ │ └─○x64 printable operands   │ ├─▷ASCII Art   │ ├─○kernel32   │ ├─○GetPC   │ └─▷Egg hunt   ├─▷Windows internals   ├─○Vulnerabilities   ├─○Heap spraying   └─○List of security teams contact information

Contents 1 See also

---

ALPHA3's alphanumeric mixedcase ASCII decoders for x86 all use Hacking/Shellcode/Alphanumeric/IMUL 0x30 encoding. They all require their base address to be provided in a certain register or memory location. I've created implementations for the following base address sources:

• [register]: [EAX], [EBX], [ECX], [EDX], [ESI], [EDI], [ESP]

See also

• x86 printable opcodes - A list of all available opcodes for alphanmeric code on x86.
• IMUL 0x30 encoding - A description of the technique used to encode/decode the data.

---

SkyLined would like to thank the following people:

• rix for the phrack article on aphanumeric shellcode.
• obscou for the phrack article on unicode-proof shellcode.
• Costin Ionescu for the idea behind w32 SEH GetPC code.
• tms320/ph4nt0m Security Team for the article on using a different IMUL value in my alphanumeric decoders.
• jamikazu for this VML fill method BoF exploit that points the SEH to the heap to bypass Software DEP .