Loading and running shellcode in a debugger is problematic because shellcode is usually just a binary chunk of data that cannot run in the same way as a normal executable. To make things easier, we’ll use shellcode_launcher.exe (included with the labs available at http://www.practicalmalwareanalysis.com/) to load and jump to pieces of shellcode.

As discussed in Chapter 5, loading shellcode into IDA Pro for static analysis is relatively simple, but the user must provide input during the load process, since there is no executable file format that describes the contents of shellcode. First, you must ensure the correct processor type is selected in the load process dialog. For samples in this chapter, you can use the Intel 80x86 processors: metapc processor type and select 32-bit disassembly when prompted. IDA Pro loads the binary but performs no automatic analysis (analysis must be done manually).