Showing posts with label Reverse Engineering. Show all posts
Showing posts with label Reverse Engineering. Show all posts

Wednesday, October 22, 2014

Understanding an example Shellcode

Example:

1 xor ebx, ebx
2 mov ebx, fs:[0x30]
3 mov ebx, [ebx + 0x0c]
4 mov ebx, [ebx + 0x1c]
5 mov ebx, [ebx]
6 mov ebx, [ebx + 0x08]

Instruction 1: xor ebx, ebx
clear ebx

Instruction 2: mov ebx, fs:[0x30]
get a pointer to the PEB