Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect it to work? (Assembling & linking for windows instead of linking for linux) I have tested a simple XOR encoder/decoder on linux with success using the steps listed below. In short, I have a WORKING XOR encoder/decoder system and I tried using win764 message box shellcode with my encode/decode sytem.(I know this seems obvious I can't run shellcode from linux to windows but there is more to it) I simply replaced the extracted shellcode from the Win7 message box into my encode/decode system. Assembled with nasm -fwin64 then linked with golink on windows to get an exe and it crashes every time. (Tested steps without encoder and assemble/link/execute work perfectly) 1. I am assembling the XOR decoder for windows - nasm **-fwin64** (with message box shellcode pasted in) 2. linking for windows using golink 3. Failing to execute on windows **This is the Linux XOR encode/decode method that works great**. _____ 1. Uses HelloWorld.nasm 2. Assemble with - nasm -felf64 HelloWorld.nasm -o HelloWorld.o 3. Extract shellcode with - for i in $(objdump -d [binary-or-objectfile] |grep "^ " |cut -f2); do echo -n '\x'$i; done;echo 4. Place HelloWorld shellcode in C wrapper #include<stdio.h> #include<string.h> unsigned char code[] = \ "\xeb\x1e\x5e\x48\x31\xc0\xb0\x01\x48\x89\xc7\x48\x89\xfa\x48\x83\xc2\x22\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xdd\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x20\x0a"; int main() { printf("Shellcode Length: %d\n", (int)strlen(code)); int (*ret)() = (int(*)())code; ret(); } 5. Run ./HelloWorld (validated that shellcode works in C wrapper) _____ Now, I use a simple XOR encoder with python to XOR the HelloWorld shellcode. ____ 1.python XOREncoder.py XORed HelloWorld shellcode formated for nasm output: 0x41,0xb4,0xf4,0xe2,0x9b,0x6a,0x1a,0xab,0xe2,0x23,0x6d,0xe2,0x23,0x50,0xe2,0x29,0x68,0x88,0xa5,0xaf,0xe2,0x9b,0x6a,0xe2,0x29,0x6a,0x96,0xe2,0x9b,0x55,0xa5,0xaf,0x42,0x77,0x55,0x55,0x55,0xe2,0xcf,0xc6,0xc6,0xc5,0x8a,0xfd,0xc5,0xd8,0xc6,0xce,0x8a,0xa0 1. Place XORed shellcode in XORdecoder.nasm like this: global _start section .text _start: start: jmp find_address decoder: pop rdi xor rcx, rcx add cl, 50 decode: xor byte [rdi], 0xAA inc rdi loop decode jmp short encoded_shellcode find_address: call decoder encoded_shellcode: db 0x41,0xb4,0xf4,0xe2,0x9b,0x6a,0x1a,0xab,0xe2,0x23,0x6d,0xe2,0x23,0x50,0xe2,0x29,0x68,0x88,0xa5,0xaf,0xe2,0x9b,0x6a,0xe2,0x29,0x6a,0x96,0xe2,0x9b,0x55,0xa5,0xaf,0x42,0x77,0x55,0x55,0x55,0xe2,0xcf,0xc6,0xc6,0xc5,0x8a,0xfd,0xc5,0xd8,0xc6,0xce,0x8a,0xa0 2. Assembled with - nasm -felf64 HelloWorldEncoded.nasm -o HelloWorldEncoded.o 3. Compiled with GCC and tested. WORKS! ___ **NOW, here is the issue on Windows 7 64** I found a great example of a WIN 7 64 bit messagebox.nasm that just pops a message box [here][1]. So naturally I wanted to test my XOR decoder. So I tried to assemble and link my decoder for windows like this. I tested this using these steps described in the link: 1. nasm -f **win64** messageBox64bit.asm -o messageBox64bit.obj 2. golink /console messageBox64bit.obj 3. Execute on Win764 ./messageBox64bit.exe GREAT! messageBox64bit.exe pops the message box. Now the ISSUE. 1. I assembled messageBox64bit.nasm with nasm 2. ran extracted messagebox shellcode through XOR encoder 3. pasted asm friendly XOR encoded shellcode into decoder 4. Adjust RCX (cl) counter for new shellcode length 5. Assembled decoder with nasm with -fwin64 option 6. Linked with golink /console messageBox64bit.obj 7. Try to execute on WIN 7 64. It crashes every damn time What is wrong here?. EDIT: Crashes in windbg on the XOR function: Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. xordecoder2+0x1009: 00000000`00401009 8037aa xor byte ptr [rdi],0AAh ds:00000000`00401018=e7 0:000> t ds:00000000`00401018=e7 0:000> t [1]: https://www.tophertimzen.com/blog/windowsx64Shellcode/