Windows shellcode

Windows shellcodes are more complicated than Linux ones. In Windows, you can't directly use sysenter or interrupts like in Linux as the system function IDs change from one version to another. Windows provides interfaces to access their functionality in libraries such as kernel32.dll. Windows shellcodes have to find the kernel32.dll's ImageBase and go through its export table to get the required APIs to implement their functionality. In terms of socket APIs, attackers may need to load additional DLLs using LoadLibraryA or LoadLibraryExA.

Windows shellcodes follow these steps to achieve their target:

1. Get the absolute address (we covered this in the previous section).
2. Get the kernel32.dll's ImageBase.
3. Get the required APIs from kernel32.dll.
4. Execute the payload.

Now that we've covered how a shellcode gets its absolute address, we will take a look at how it gets the kernel32.dll's ImageBase.