How to decode and disassemble shellcode

Never run bytes you have not read — especially bytes you did not write. Decoding and disassembling shellcode tells you what it actually does and surfaces problems before they cost you an exploit attempt. For background, see what shellcode is.

Why decode shellcode

Three reasons:

• Trust — an example off the internet might do more than it claims.
• Debugging — your own payload "doesn't work" and you need to see what assembled.
• Bad-char hunting — find forbidden byte values before delivery, not after.

Common encodings

Shellcode travels in several skins. You usually decode to raw bytes first:

Strip the wrapper, get the bytes, then disassemble.

Disassembling to mnemonics

Raw bytes mean nothing until you turn them back into instructions. A disassembler decodes them to assembly so \x31\xc0 reads as xor eax, eax. The Shellcodes converter does this with Capstone mnemonics and picks up where one instruction ends and the next begins — which is how you catch a payload that does something other than advertised.

Reading the bytes

The disassembly tells you the logic; a hex view tells you about the bytes themselves — embedded strings, suspicious values, and forbidden characters. What to look for before you copy anything is in what the hex viewer tells you.

One trap worth calling out: disassemble in the wrong CPU mode and you get plausible-looking garbage. The same bytes decode differently as 32-bit and 64-bit, so an x64 payload read as x86 produces instructions that are real but wrong. Always set the architecture to match the payload before you trust a single line of the output.

Decode it now

Paste an escaped or hex blob into the Shellcodes converter to normalize the format and disassemble it. Confirm it matches your intent, check it against your bad-char set, and only then run it — inside an isolated lab you control. Authorized testing only: responsible use.