Shellcode Technique – Exported Function Parsing
In this chapter, we will learn how to get the desired API address from loaded dynamic link library (DLL) modules so that we can master the knowledge necessary to write shellcode to execute in Windows memory. To do so, we will first learn about the export address table (EAT) structure in PE, build our own DLL parser, and write new Windows shellcode from scratch in x86. Once we have finished this chapter, we will be able to develop a Windows shellcode generator in Python, which we can later call to use to achieve the desired functionality.
In this chapter, we’re going to cover the following main topics:
- EATs in PE
- Examples of a DLL file analyzer
- Examples of writing shellcode in x86
- A shellcode generator in Python
