Shellcode is often treated as a dark art: small, opaque, and inseparable from exploit folklore. This workshop takes the opposite approach. It breaks shellcode down as a disciplined form of constrained systems programming, where every byte, register, calling convention, memory reference, and control-flow decision matters.
Participants will learn how shellcode is structured, how position-independent code works, and why common instruction patterns such as call/pop, base-register anchoring, stack construction, and compact control-transfer sequences appear so frequently in real-world payloads. The workshop will also cover Windows internals relevant to shellcode, including TEB and PEB access, API discovery, API hashing, syscall resolution, and indirect syscall techniques. Finally, it will explore more advanced building blocks such as tiny disassemblers, trampolines, and API interception hooks.
The goal is not to teach copy-paste payload development, but to give reverse engineers, malware analysts, exploit developers, and detection engineers a clear mental model for how shellcode actually works.
Shellcode sits at the intersection of exploit development, reverse engineering, operating system internals, compiler behavior, and malware analysis. It is small by design, but the ideas packed into it are dense: position independence, register discipline, stack layout, calling conventions, import resolution, syscall mechanics, and runtime code modification. This workshop is designed to make those ideas understandable and practical for security researchers who want to read, write, analyze, and detect shellcode with confidence.
The workshop begins with the fundamentals: what shellcode is, what constraints it normally operates under, and how those constraints shape its design. We will look at how shellcode avoids absolute addresses, how it locates its own data, and how instruction sequences can be combined to replace unavailable or undesirable operations. Examples include techniques such as call/pop for recovering a pointer to embedded data, using a register as a shellcode-relative base pointer, constructing strings and arguments on the stack, and reasoning about code that must execute correctly regardless of where it lands in memory.
From there, the workshop moves into Windows-specific shellcode internals. We will examine how shellcode can discover process and module state without relying on normal imports, including TEB and PEB access, walking loader structures, resolving API addresses manually, and implementing API hashing. These topics are especially useful for malware analysts and detection engineers because they explain the recurring patterns seen in unpacked payloads, loaders, implants, and post-exploitation tooling.
The workshop then covers syscall-oriented shellcode. Participants will learn how user-mode API calls transition into kernel services, why direct and indirect syscall techniques exist, what tradeoffs they introduce, and how syscall resolution interacts with OS versioning, user-mode hooks, and EDR visibility. The focus will be on understanding the mechanisms and their analytical implications rather than treating syscalls as a magic bypass.
The final section explores more advanced shellcode building blocks: tiny disassemblers, instruction-length decoding, trampolines, inline hooks, and API interception. We will discuss how a compact decoder can be used to identify safe overwrite boundaries, install a trampoline, preserve original instructions, and redirect execution through a hook function. This portion connects shellcode development directly to the mechanics used in instrumentation, unpacking, malware loaders, and defensive research tooling.
All material is presented in a controlled lab context, with emphasis on responsible research, analysis, and defensive understanding. Attendees should leave with a practical framework for recognizing shellcode patterns, understanding why they work, and reasoning about small pieces of machine code with much greater precision.