now it works

README.md

@@ -6,12 +6,13 @@ This script helps automate the shellcode testing process. It takes an Assembly f
 
 ## Usage
 
-Shellcoder most probably should be used on Windows because of the MSVC requirement.
+Shellcoder script most probably should be used on Windows because of the MSVC requirement.
 
-```powershell
-# Run script
-python shellcoder.py
-```
+1. Write your shellcode in `shellcode.asm`
+2. Run `python shellcoder.py`
+3. Execute output `.exe` file in `out/` directory!
+
+> **IMPORTANT**: Indicate that you are using 64-bit mode at the beginning of the assembly file. Add `[bits 64]` to the `shellcode.asm`.
 
 ## External dependencies
 

loader.c

@@ -1,4 +1,7 @@
 #include <windows.h>
+#include <stdio.h>
+unsigned char payload[] = ":PAYLOAD:";
+unsigned int payload_len = sizeof(payload);
 
 void main() {
   void* exec;
@@ -7,12 +10,13 @@ void main() {
   DWORD oldprotect = 0;
 
   // Shellcode
-  unsigned char payload[] = ":PAYLOAD:";
-  unsigned int payload_len = 205;
   exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
   RtlMoveMemory(exec, payload, payload_len);
   rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);
+
+  printf("[+] Exec...");
   th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);
   WaitForSingleObject(th, -1);
+  printf("[+] End...");
 
 }

shellcode.asm

@@ -1,7 +1,5 @@
-; Compile & get shellcode from Kali:
-;   nasm -f win64 popcalc.asm -o popcalc.o
-;   for i in $(objdump -D popcalc.o | grep "^ " | cut -f2); do echo -n "\x$i" ; done
-; Get kernel32.dll base address
+[bits 64]
+
 xor rdi, rdi            ; RDI = 0x0
 mul rdi                 ; RAX&RDX =0x0
 mov rbx, gs:[rax+0x60]  ; RBX = Address_of_PEB

shellcoder.py

@@ -16,6 +16,11 @@
 #   - NASM (Netwide Assembler)
 #   - Visual Studio 2022
 
+"""
+[ ] Sprawdz czy zwykly shellcode dziala
+[ ] Moze NASM trzeba jakos inaczej kompilowac / pobierac?
+"""
+
 import subprocess
 import os
 import sys
@@ -65,7 +70,7 @@ if __name__ == "__main__":
 
     # Compile Assembly
     subprocess.run(
-        ["nasm", "-f", "win64", SHELLCODE_INPUT_FILE, "-o", SHELLCODE_OUTPUT_FILE], check=True
+        ["nasm", "-f", "bin", SHELLCODE_INPUT_FILE, "-o", SHELLCODE_OUTPUT_FILE], check=True
     )
 
     print(f"[+] NASM: {SHELLCODE_INPUT_FILE} -> {SHELLCODE_OUTPUT_FILE}")