diff --git a/exploit/windows/Portable Executables/Shellcode.md b/exploit/windows/Portable Executables/Shellcode.md new file mode 100644 index 0000000..ab2a03f --- /dev/null +++ b/exploit/windows/Portable Executables/Shellcode.md @@ -0,0 +1,20 @@ +# PE Shellcode + +## General PE Information + +* [PE structure](../../../reverse engineering/windows/portable-executable.md) + +## Inserting Shellcode + +Multiple sections inside the PE can be used to insert the shellcode. This is defined by how the shellcode variable is initialized. When the shellcode is defined as +* A __local variable__ inside the main function it will be stored in the `.text` section +* A __global variable__ it will be stored in the `.data` section +* A __raw binary__ in an icon image and referencing it will store it in the `.rsrc` section +* A __custom data section__ it is stored in this unusual section + +## Crafting Shellcode + +## Tools & Tipps + +* [hasherezade's PE-bear](https://github.com/hasherezade/pe-bear-releases.git) gives an overview of the PE's sections +* [asmtutor.com](https://asmtutor.com)