Visual Studio Shellcode Generation Project

This project enables users to write position-independent code (PIC), or shellcode, in Visual Studio for both x86 and x64 platforms.

Features

Supports both x86 and x64 code generation

Use API's normally- link the proper .lib and that is it, no need to manually resolve function pointers

Produces both .exe and .bin, allowing for easy testing of extracted shellcode

Output is highly configurable, with options for shellcode output format, compression, and encryption

Usage

1. Clone the project and open sc.sln.
2. Build LIB/prepare and LIB/ScEntry for both x86 and x64!
3. Write your program in template\ep.cpp as normal. To use API's from other libraries, add the correct header and then add the corresponding .lib in the template project's Properties -> Configuration Properties -> Linker -> Input -> Additional Dependencies.
4. Use the _YA() and _YW() macros to wrap ANSI and UNICODE strings respectively. Further, any functions passed as callback arguments to APIs should be passed with the _Y() macro. This is required by the x86 build. See the Hello project for examples of both of these macros.
5. Compile the template project. Note that due to how this template works, compiling may fail with an error like The command C:\Users\User\Desktop\SC_DEMO-main\SC_DEMO-main\x64\Release\template.exe" *C:\Users\User\Desktop\SC_DEMO-main\SC_DEMO-main\x64\Release\template.map*x64.obj*imp.x64.asm*template.x64.bin*template.x64.asm*template.x64.exe. This has to do with how the project handles new API calls the first time they are used/seen in a program, so just build once more and you are good to go.
6. Find your compiled assets at SC_DEMO\template\template.x64.exe and SC_DEMO\template\template.x64.bin (same place but .x86. for x86 architecture).

Description of Assets

• NewScProj: This project produces NewScProj.exe, which can be used to easily create a new project within the overall solution. Usage: NewScProj.exe *projectname*vcp. This will produce/populate a new folder called projectname, which can then be imported into the SC solution by right-clicking the solution -> Add -> Existing Project.
• Hello: This is just a demo project of some of the template's capabilities.
• ScEntry: This defines the shellcode entry point and is required to build Template or other shellcode projects.
• Prepare: This DLL does post-processing work on the generated project executable to extract the shellcode.
• Template: This is a clean/blank project that can be used to create your own shellcode.
• Msvcrt: This contains the files necessary to create msvcrt.lib, which must be linked to use certain C runtime functions like printf. When compiled, this library is created at lib\<arch>\msvcrt.lib and can then be linked to by including msvcrt.lib as described in step 3 of the Usage section above.

Additional Information

1. Shellcode can be produced to work in both EXECUTE_READWRITE (RWX) AND EXECUTE_READ (RX) memory. By default it is generated to support RX memory, which slightly increases its total size as it must be PAGE aligned. If you should want to compile the shellcode to work in RWX memory (and be smaller), uncomment line 3 in template\x86.asm and line 7 in template\x64.asm.
2. As mentioned in the asset description, some C-runtime functions like printf present a challenge to use due to linker issues concerning the lack of a mscvrt.lib file. The msvcrt folder included in this repo can be built to create msvcrt.lib, which can then be included in projects. This code was generated using the ExportPolicy project. Should you want to do this yourself, clone the ExportPolicy repo, use MakeLib.exe *msvcrt to create a project containing the required files within the solution, and then compile it to produce the .lib file.
3. The inner workings of the shellcode project, including more on how ScEntry and Prepare work and configuration options, are further detailed in this repo. This repository also contains a number of advanced projects that leverage the shellcode template, and is a good source of inspiration / ideas as to just how far this template can be pushed.