Alphanumeric shellcode

In computer security alphanumeric shellcode is a shellcode that consists of or assembles itself on execution into entirely alphanumeric ASCII or Unicode characters such as 0-9, A-Z and a-z.^[1][2] This type of encoding was created by hackers to hide working machine code inside what appears to be text. This can be useful to avoid detection of the code and to allow the code to pass through filters that scrub non-alphanumeric characters from strings (in part, such filters were a response to non-alphanumeric shellcode exploits). A similar type of encoding is called printable code and uses all printable characters (0-9, A-Z, a-z, !@#%^&*() etc...) It has been shown that it is possible to create shellcode that looks like normal text in English.^[3]

Writing alphanumeric or printable code requires good understanding of the instruction set architecture of the machine(s) on which the code is to be executed. It has been demonstrated that it is possible to write alphanumeric code that is executable on more than one machine.^[4]

See also

• EICAR test file - a test pattern used to test the installation of the anti virus software, which is written in printable code.

Further reading

• Writing ia32 alphanumeric shellcodes, an article on how to write alphanumeric shellcode.
• Building IA32 'Unicode-Proof' shellcodes, an article on how to write Unicode proof shellcode.
• Writing IA32 restricted instruction set shellcodes, an article on how to write code that is very limited in the number of characters it can use (such as alphanumeric code).
• ALPHA3, an alphanumeric shellcode encoder: Utility to encode normal machine code into alphanumeric (upper-case or mixed-case) ASCII or Unicode text.
• List of x86 Alphanumeric opcodes
• List of x64 alphanumeric opcodes
• Shellcoding for Linux and Windows — Printable Shellcode: Explanation and tutorial

References