Using CALL $+5 to Build Position-Independent Shellcode

Summary

A hands-on tutorial demonstrates using CALL, POP, and LEA to find shellcode’s runtime base address, then verifies the result while assembling and debugging the code.

Key points

• The tutorial explains why shellcode needs to locate itself when its memory allocation address is not fixed.
• A CALL instruction pushes its return address onto the stack; POP stores that address in EDX.
• LEA subtracts five from the return address to derive the beginning of the shellcode region.
• The presenter assembles the code with NASM and examines it in IDA.
• The tutorial uses SC launcher and WinDbg to observe the allocation address and confirm the resulting pointer.
• The recovered base address can help shellcode locate data such as strings at offsets relative to its runtime location.

Tools

Related Articles

• Shellcode Basics: Build Environment, Required Tools and Series ResourcesDr Josh Stroschein - The Cyber YetiIDA · NASM
• Tutorial Demonstrates Custom Shellcode Execution via a Stack PivotDr Josh Stroschein - The Cyber YetiIDA · NASM
• Midnight Mimosa Malware Preinstalled on Android Phones Enables Ad Fraud and Proxy Botnetsbitdefender.comIDA
• Yarden Shafir Discusses Windows AI Agent Isolation and Security ResearchJohn HammondIDA
• Underground Malware Operation Drains Crypto Accounts Through Injected Browser Sessionsnetskope.comIDA