The Coroner's Report: A Guided Autopsy of msfvenom's Windows Shellcode
This will be an interactive lab covering the reverse engineering of msfvenom’s stageless Windows x64 reverse TCP shellcode. We will cover the basics of Windows internals, x86_64 assembly code in Windows, as well as the obfuscation techniques used by the shellcode author in an attempt to hinder static analysis.
To participate in the lab, you will need a fresh Windows 11 VM with 2 cpu cores, 4GB of RAM, and 64GB of disk space allocated. A script has been provided to set up the VM with the necessary software and configurations before the talk: