README

Overview

This project contains Windows x86 shellcode written in MASM32.
The shellcode dynamically resolves API functions from kernel32.dll and advapi32.dll without relying on imports.
Its main purpose is to enumerate all running Windows services and dump their names into a file called services.txt.

---

Technical Details

Step 1. Resolve kernel32.dll

• The code walks the PEB (Process Environment Block) to locate the base address of kernel32.dll.
• This avoids using imports and keeps the shellcode position-independent.

Step 2. Parse Export Directory

• A helper routine (GetExportTableInfo) extracts key information from the PE export table:
  • Number of exported functions
  • Export Address Table
  • Name Pointer Table
  • Ordinal Table

Step 3. Resolve API Functions

• Another helper (FindProcVA) looks up function addresses by name using the previously gathered export structures.
• The following functions are resolved from kernel32.dll:
  • CreateFileA
  • WriteFile
  • LoadLibraryA
• Then advapi32.dll is loaded dynamically, and from it the code resolves:
  • OpenSCManagerA
  • EnumServicesStatusA

Step 4. Create Output File

• A file named services.txt is created in the current directory with CreateFileA.
• A handle to the file is saved for writing service names.

Step 5. Open Service Control Manager

• Using OpenSCManagerA, a handle to the SCM database is obtained with the right SC_MANAGER_ENUMERATE_SERVICE.

Step 6. Enumerate Services

• A 1024-byte buffer is allocated on the stack.
• EnumServicesStatusA is called repeatedly to retrieve service entries in pages.
• Each service name is extracted from the returned structures.

Step 7. Write to File

• For each service name:
  • Its length is measured and truncated if needed (respecting a remaining write limit).
  • The name is written to services.txt via WriteFile.
  • A \r\n (CRLF) is appended after each name.
• The loop continues until all services are written or the limit is exceeded.

Step 8. Exit

• On completion or error, the shellcode restores registers and stack state, then returns.

---

Key Characteristics

• Position-independent code (no imports, no absolute addresses).
• Null-free strings are constructed on the stack.
• PE structures are parsed manually to resolve function addresses.
• Stealthy API resolution through PEB and export parsing.
• Writes a snapshot of running services into a file.