shellcode-analyze

Shellcode analysis reveals executed instructions, mapped system calls, and embedded strings. By disassembling the payload, you uncover network indicators like domains and IPs, providing actionable threat insights without executing the malicious code.

Yes, you can disassemble both x86 and x64 shellcode on Windows and Linux. The Skill leverages the Capstone library to translate raw binary payloads into readable assembly instructions for rapid threat triage.

The best way to extract strings and C2 indicators is to apply the analysis script directly to files containing shellcode. It identifies embedded text, URLs, and network patterns to generate a structured threat assessment report.

Yes, you need to install the Capstone library and the Python script in scripts/disassemble.py. These dependencies are required to execute the disassembly, string extraction, and network pattern detection workflows.

To map system calls to function names, feed the hex-encoded shellcode into the analysis workflow. The Skill automatically recognizes system calls and translates them into function names to facilitate incident response triage.