What is shellcode? A complete guide

Shellcode is a small piece of position-independent machine code that runs as the payload of an exploit. When a bug hands you control of the instruction pointer, the shellcode is what executes next. This guide covers what it is, the common types, the constraints that break it, and how to generate and analyze it safely.

What is shellcode?

Shellcode is raw CPU instructions, not a program you run from a shell. It has no loader, no headers, and no linker — just bytes that a processor executes directly once your exploit redirects control to them. Because it lands at an address you do not know in advance, it has to be position-independent: no hardcoded absolute addresses, everything relative.

Why is it called "shellcode"?

The original payloads did one thing: launch a command shell (/bin/sh on Unix, cmd.exe on Windows), giving the attacker interactive control. The name outlived the narrow meaning. Today "shellcode" refers to any small machine-code payload, whether it opens a shell, dials home, or loads a larger stage.

How shellcode works

A typical flow:

A vulnerability (stack overflow, use-after-free, format string) lets you overwrite a control value.
You redirect execution to a buffer you control.
The CPU starts executing your bytes as instructions.
The shellcode sets up registers and invokes a system call to do its work.

On Linux that final step is usually a syscall/int 0x80 instruction; on Windows it resolves and calls API functions. Either way the code must be self-contained and survive whatever memory protections are in play.

Types of shellcode

Exec / local — runs a command in place. Small and quiet. Good when you already have a channel.
Reverse TCP — connects back to your listener for an interactive session.
Bind — opens a port on the target and waits.
Staged vs stageless — a small stager pulls down a larger payload, versus shipping everything at once.

Which one to use is a function of the primitive and the environment, not the one that looks coolest. See Linux exec vs reverse TCP for the trade-off.

What shellcode looks like

A 25-byte Linux x86 execve("/bin/sh"):

\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80

Those bytes zero a register, push /bin//sh onto the stack, set up the execve arguments, and trigger the syscall. For more, with the disassembly alongside, see shellcode examples.

Bad characters and null bytes

Delivery often passes your bytes through string functions. A single 0x00 can truncate strcpy-style copies and cut your payload in half; newlines, spaces, and slashes break other parsers. This is why payloads get encoded to avoid specific byte values. It is also where most "it worked in the debugger, not on the target" failures come from — see null bytes in shellcode.

How shellcode is generated

Three common routes — hand-written assembly, a framework like msfvenom, or a generator that assembles and encodes for you. They differ in control, portability, and how much trust you place in someone else's bytes. The full comparison is in how to generate shellcode. You can build and encode payloads entirely client-side in the Shellcodes builder without installing a framework.

How to analyze shellcode

Before you run bytes — especially bytes you did not write — decode and disassemble them. Turning a \x-escaped blob back into mnemonics tells you what it actually does and surfaces bad characters. The Shellcodes converter disassembles with Capstone; the workflow is in decode and disassemble shellcode.

Legal and ethical use

Shellcode is dual-use. Writing, generating, and testing it is legitimate for authorized penetration tests, CTFs, exploit research, and detection engineering — and illegal against systems you do not own or have permission to test. Keep it in labs and scoped engagements. See the responsible use policy.

FAQ

Is shellcode a virus? No. It is a payload technique. It becomes malicious only when paired with an exploit against a target you are not authorized to test.

What language is shellcode written in? Assembly, then assembled to raw machine-code bytes. People often prototype the logic in C to find the right syscalls.

How do I run shellcode safely? In an isolated lab VM or container you control, after decoding and disassembling it so you know exactly what it does.