Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect it to work? (Assembling & linking for windows instead of linking for linux)

I have tested a simple XOR encoder/decoder on linux with success using the steps listed below. In short, I have a WORKING XOR encoder/decoder system and I tried using win764 message box shellcode with my encode/decode sytem.(I know this seems obvious I can't run shellcode from linux to windows but there is more to it)

I simply replaced the extracted shellcode from the Win7 message box into my encode/decode system. Assembled with nasm -fwin64 then linked with golink on windows to get an exe and it crashes every time. (Tested steps without encoder and assemble/link/execute work perfectly)

1. I am assembling the XOR decoder for windows - nasm -fwin64 (with message box shellcode pasted in)
2. linking for windows using golink
3. Failing to execute on windows

This is the Linux XOR encode/decode method that works great.

1. Uses HelloWorld.nasm

2. Assemble with - nasm -felf64 HelloWorld.nasm -o HelloWorld.o

3. Extract shellcode with - for i in $(objdump -d [binary-or-objectfile] |grep "^ " |cut -f2); do echo -n '\x'$i; done;echo

4. Place HelloWorld shellcode in C wrapper

   #include<stdio.h>
   #include<string.h>
   
   unsigned char code[] = \
   "\xeb\x1e\x5e\x48\x31\xc0\xb0\x01\x48\x89\xc7\x48\x89\xfa\x48\x83\xc2\x22\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xdd\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x20\x0a";
   
   int  main()
   {
   
           printf("Shellcode Length:  %d\n", (int)strlen(code));
   
           int (*ret)() = (int(*)())code;
   
           ret();
   
   }
   

5. Run ./HelloWorld (validated that shellcode works in C wrapper)

Now, I use a simple XOR encoder with python to XOR the HelloWorld shellcode.

1.python XOREncoder.py

XORed HelloWorld shellcode formated for nasm output:

          0x41,0xb4,0xf4,0xe2,0x9b,0x6a,0x1a,0xab,0xe2,0x23,0x6d,0xe2,0x23,0x50,0xe2,0x29,0x68,0x88,0xa5,0xaf,0xe2,0x9b,0x6a,0xe2,0x29,0x6a,0x96,0xe2,0x9b,0x55,0xa5,0xaf,0x42,0x77,0x55,0x55,0x55,0xe2,0xcf,0xc6,0xc6,0xc5,0x8a,0xfd,0xc5,0xd8,0xc6,0xce,0x8a,0xa0

1. Place XORed shellcode in XORdecoder.nasm like this:

   global _start
   
   section .text
   
   _start:
   
   
   start:
           jmp find_address
   
   decoder:
           pop rdi
           xor rcx, rcx
           add cl, 50
   decode:
           xor byte [rdi], 0xAA
           inc rdi
           loop decode
   
           jmp short encoded_shellcode
   
   find_address:
           call decoder
   
           encoded_shellcode: db 0x41,0xb4,0xf4,0xe2,0x9b,0x6a,0x1a,0xab,0xe2,0x23,0x6d,0xe2,0x23,0x50,0xe2,0x29,0x68,0x88,0xa5,0xaf,0xe2,0x9b,0x6a,0xe2,0x29,0x6a,0x96,0xe2,0x9b,0x55,0xa5,0xaf,0x42,0x77,0x55,0x55,0x55,0xe2,0xcf,0xc6,0xc6,0xc5,0x8a,0xfd,0xc5,0xd8,0xc6,0xce,0x8a,0xa0
   

2. Assembled with - nasm -felf64 HelloWorldEncoded.nasm -o HelloWorldEncoded.o

3. Compiled with GCC and tested. WORKS!

NOW, here is the issue on Windows 7 64

I found a great example of a WIN 7 64 bit messagebox.nasm that just pops a message box here. So naturally I wanted to test my XOR decoder. So I tried to assemble and link my decoder for windows like this.

I tested this using these steps described in the link:

1. nasm -f win64 messageBox64bit.asm -o messageBox64bit.obj

2. golink /console messageBox64bit.obj

3. Execute on Win764 ./messageBox64bit.exe

GREAT! messageBox64bit.exe pops the message box. Now the ISSUE.

1. I assembled messageBox64bit.nasm with nasm
2. ran extracted messagebox shellcode through XOR encoder
3. pasted asm friendly XOR encoded shellcode into decoder
4. Adjust RCX (cl) counter for new shellcode length
5. Assembled decoder with nasm with -fwin64 option
6. Linked with golink /console messageBox64bit.obj
7. Try to execute on WIN 7 64.

It crashes every damn time What is wrong here?.