From 79a3f73e9e51e59db51cf8870ca09faeec36368e Mon Sep 17 00:00:00 2001 From: "SECURED.ORG" Date: Wed, 9 Aug 2017 19:33:49 -0700 Subject: [PATCH] Update re102_section4.3.md --- RE102/re102_section4.3.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/RE102/re102_section4.3.md b/RE102/re102_section4.3.md index e60454e..ebe5639 100644 --- a/RE102/re102_section4.3.md +++ b/RE102/re102_section4.3.md @@ -31,21 +31,17 @@ There are many tools and scripts available that help you convert shellcode into [http://www.godevtool.com/Golink.zip](http://www.godevtool.com/Golink.zip) 4. Extract golink.exe 5. Create a **decrypted_shellcode.asm** file with the following instructions - ``` Global Start SECTION 'AyyLmao' write, execute,read Start: incbin "decrypted_shellcode.bin" ``` -6.From a command line run the following command to assemble the code: - +6. From a command line run the following command to assemble the code: ``` yasm.exe -f win32 -o decrypted_shellcode.obj decrypted_shellcode.asm ``` - 7. Now run the linker - ``` golink /ni /entry Start decrypted_shellcode.obj ``` @@ -53,4 +49,4 @@ golink /ni /entry Start decrypted_shellcode.obj Finally, open the decrypted_shellcode.exe into IDA for Section 5. -[Section 4.2 <- Back](https://securedorg.github.io/RE102/section4.2) | [Next -> Section 5](https://securedorg.github.io/RE102/section5) \ No newline at end of file +[Section 4.2 <- Back](https://securedorg.github.io/RE102/section4.2) | [Next -> Section 5](https://securedorg.github.io/RE102/section5)