rapid7/metasploit-framework — pull request #3078 by schierlm (2014-03-07 18:24:10+00:00)
Title: More shellcode golf

Save a few more bytes (as described in my comments to https://community.rapid7.com/community/metasploit/blog/2014/02/14/shellcode-golf):

- No need to clear EAX in block_api if we can keep the upper 3 bytes zero
- Reshuffle some blocks to save some jumps
- No need to set flags if previous instruction has set them as side effect already
- Pushing several NULLs is shorter to do in a loop instead of individually
- inc eax is shorter than inc ax; if we discard both flags and the rest of eax afterwards, it does not matter.

Note:
- Some reshuffling requires more available stack depth now (but should not matter in practice since the stage will usually need a lot more stack anyway)
- I only rebuilt a few binary blobs, as somebody from Rapid7 has to rebuild the rest anyway.
- If it is not required that the _allports stager tries the ports in order, you could increment the port just "in place" with the two bytes swapped and save quite a lot more bytes
- Of course, using a shorter URI in the http(s) stagers could save some more bytes, too. But that would require changes to the Ruby code as well.