Hadrian Barral - The ABC of Next Gen Shellcoding

Modern Shellcoding Tradecraft

Hadrian Barral presents an updated shellcoding methodology that addresses the challenges introduced by modern exploit mitigations — ASLR, NX/DEP, stack canaries, and AV signature detection.

Position-Independent Shellcode

Classic shellcodes relied on fixed addresses. Barral demonstrates PIC techniques using delta stubs, hash-based API resolution, and EAT walking to locate and call Windows API functions without hardcoded addresses.

Gadget-Assisted Execution

For scenarios where classic shellcode is blocked by NX, Barral combines short-form ROP chains that pivot execution to a decoded shellcode stub, bypassing both DEP and common signature-based detections.

AV Evasion at the Shellcode Level

The talk covers junk code insertion, polymorphic encoding schemes, and sleep-before-decode techniques that defeat dynamic sandboxes with short analysis windows.