[0x00] No Strings Attached: Shellcoding for Red Teamers

Introduction

Welcome to the Shellcode Development series.
This introductory post lays out what to expect in this series: the tools we’ll use, the prerequisites you’ll need, and how to prepare your machine for hands-on work.

Pre-requisite

• Curiosity
• Willingness to learn

• Patience (a lot of it!)

  Technical Background

  Recommended, but not mandatory.

• Basic understanding of C
• Familiarity with Windows internals (processes, memory, threads)
• Some exposure to x86/x64 assembly
• Comfort using Windows debugging tools (x64dbg, Process Hacker, etc.)

Tools Covered

We’ll use a mix of Windows-native and cross-platform tools for reverse engineering, debugging, and testing shellcode.

1. x64dbg – Our primary debugger for Windows shellcode
2. gdb – Briefly used to explain Linux syscall basics for context
3. NASM – For assembling shellcode (used to assemble shellcode for Windows)
4. Process Hacker / WinDbg – For observing memory and process behavior
5. Python / C / C++ – For shellcode loaders or harnesses

Later in the series, we’ll might explore more advanced tooling, including:

• msfvenom for comparison purposes
• SysWhispers / SysWhispers2 for direct syscall usage
• Donut (by TheWover) for .NET shellcode generation

BYOM (Bring your own Machine)

This series is completely hands-on, so to follow along smoothly, make sure you’ve set up your own virtual machines:

1. Windows 10
   • 4-6 GB RAM
   • 60 GB Storage
2. Optional: Linux VM (Ubuntu Preferred)
   • 4 GB RAM
   • 20 GB Storage

If you don’t want a full Linux VM, you can also use WSL (Windows Subsystem for Linux) inside your Windows machine for most parts.

Once your VMs are updated and ready, disconnect them from the internet.
This is essential when working with exploit code or malware, even if it’s custom or signatured. Prevent accidental uploads to AV vendors or cloud-based detection systems.
Make this a habit early on; you’ll thank yourself later during advanced research and red teaming.

What to expect

This shellcode development series will be focused on Windows shellcode development, specifically for the purpose of Malware development and defence evasion.

Blogs in the series

1. Shellcode 101: What the Hex is Going On?
2. Assembly: Speak the CPU’s Language
3. Coming soon…, Thanks for your patience

Disclaimer

I’m not an expert in shellcode development. This blog series is part of my personal learning journey and I may make mistakes or overlook optimization.
Constructive criticism, corrections, and suggestions are always welcome.
Feel free to reach out to me via Twitter or Linkedin.