Wednesday 21 August 2013

Convert hex shellcode to binary mode

To convert hex shellcode to binary files, a couple of easy ways can do that. Say we have hex mode strings below:
\x38\x12\x08\xab
  • Bash:
echo -ne "\x38\x12\x08\xab" > b.bin
  •  Perl:
perl -e 'print "\x38\x12\x08\xab"' > p.bin 
  • online tools such as http://sandsprite.com/shellcode_2_exe.php
 VI could be used to edit the hex of the binary files with ":%!xxd". But actually VI doesn't support hex edit, what it does is just redirect it to xxd command. However, the xxd command might add a newline character, "\n"(ASCII 0A) at the end.
On the screenshot above, the "\x0a" was added by xxd command, if it was opened with a hex editor, it didn't exist. To save the modification, need to convert it back from Hexdump first, ":%!xxd -r", and then save it.

The python command below could also convert hex to binary file, but the annoying thing is it will add a newline character, "\n"(ASCII 0A) at the end of the file. Haven't figured out how to avoid it yet.
python -c 'print "\x38\x12\x08\xab"' >py.bin

1 comment: