Wednesday, October 26, 2011

quick post: Converting shellcode to opcodes

Mainly as a note to myself, but other people might benefit from this as well.

Last night I was looking for a way to convert small bits of shellcode into the equivalent opcode. While there is metasm-shell to convert opcodes to shellcode, there is no shell to do it the other way around. Metasm has disassemble.rb, but that's only file based. A quick question in #metasploit resulted in the following one liner, which worked perfectly:

echo -ne "\xeb\xe0" |ndisasm -u -
00000000  EBE0              jmp short 0xffffffe2