Function calling convention

In the previous chapters, we learned that the compiler saves chunks of code in different sections depending on the function of the source code. For example, the code is converted to machine code and stored in the .text section, the data is stored in the .data or .rdata section, and the import address table (IAT) is stored in the .idata section, as shown in Figure 3.1:

Figure 3.1 – Native code of msgbox.exe

Shellcode is a concise machine code script. When we can hijack a thread’s program counter, such as the EIP or RIP registers or the return address, we can control it in shellcode to perform specific and precise tasks (calling a specific set of system APIs). Common behaviors (such as downloading and executing malware, reverse shell connections, pop-up windows, etc.) are all achieved by calling the system API.

However, unlike PE programs, shellcode does not run with the help of the kernel to do file mapping or...