Understanding Windows Shellcode

1 Foreword 3
2 Introduction 4
3 Shellcode Basics 5
3.1 SystemCalls . 6
3.2 Findingkernel32.dll . 6
3.2.1 PEB 7 
3.2.2 SEH 9 
3.2.3 TOPSTACK . 10
3.3 ResolvingSymbolAddresses. 11 
3.3.1 ExportDirectoryTable . 11 
3.3.2 ImportAddressTable(IAT)  13
4 Common Shellcode 15
4.1 Connectback . 15 
4.2 Portbind 21
5 Advanced Shellcode 29
5.1 Download/Execute 29
6 Staged Loading Shellcode 39
6.1 DynamicFileDescriptorRe-use. 39 
6.2 StaticFileDescriptorRe-use  42 
6.3 Egghunt 43 
6.4 Egghunt(syscall). 44 
6.5 ConnectbackIAT. 46
7 Conclusion 49
8 Detailed Shellcode Analysis 50
8.1 Findingkernel32.dll . 50 
8.1.1 PEB 50 
8.1.2 SEH 51 
8.1.3 TOPSTACK . 53
8.2 ResolvingSymbolAddresses. 54 
8.2.1 ExportTableEnumeration . 54
8.3 CommonShellcode 56 
8.3.1 Connectback . 56 
8.3.2 Portbind 63
8.4 AdvancedShellcode . 71 
8.4.1 Download/Execute 71
8.5 StagedLoadingShellcode  81 
8.5.1 DynamicFileDescriptorRe-use  81 
8.5.2 Egghunt 85 
8.5.3 Egghunt(syscall). 88 
8.5.4 ConnectbackIAT. 89