> For the complete documentation index, see [llms.txt](https://nickbhe.gitbook.io/shikata-ga-nai-1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nickbhe.gitbook.io/shikata-ga-nai-1/binary/shellcoding.md).

# Shellcoding

## Creating Shellcode

1. Write assembly code \[[Linux syscall table](https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md)].
2. Assemble: `nasm -f elf shellcode.asm`
3. Link: `ld -o shellcode shellcode.o`
4. Extract opcodes: `objdump -d shellcode`

## Relative Shellcoding

To make the shellcode more portable we don't want to rely on hardcoded values. To do so we want to hold a meaningful address in a register and work relative to it.

Here is an example of such a technique:

![](https://4085302497-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFMQjmmLeUT8hgiI8az%2F-MJBqZQDSHuFYROiGFzR%2F-MJBwDwD86Dc6Rgk1ySE%2Fimage.png?alt=media\&token=f3f80091-1bb4-4c31-bcaf-270a8dac477b)

We use `call` to push the next address to the stack and jump to our shellcode. That address is then put into `esi` and thus we can use `esi` for relative addressing. To get to `call` we place a `jmp` at the very start of the shellcode.