Heavy Wizardry 101 Shellcodes, Backdoors, Droppers, and Worms (David Martínez Oliveira) (z-library.sk, 1lib.sk, z-lib.sk)

【One-Line Pitch】 A hands-on guide to writing low-level offensive code—shellcode, reverse shells, droppers, worms—from scratch on Linux, implemented four times across x86_64, ARM, MIPS, and RISC-V. Best for penetration testers, malware analysts, and systems programmers who want to understand and build code at the instruction level rather than rely on existing toolkits. 【Book Arc】 - **Opening (~0%–10%)**: Frames the "heavy wizardry" mindset and sets up the toolchain—building a minimal computer model, writing and assembling first programs, and getting the same trivial program to build for ARM, MIPS, and RISC-V. Solves the "how does code actually reach the metal" problem. - **Early (~10%–35%)**: Moves from C down to assembly: system calls, `_start` vs. `main`, static vs. dynamic binaries, dropping libc, linker flags, and per-architecture syscall conventions. Then covers data representation, memory layout, endianness, and writing a first "Hello, World!" shellcode. - **Middle (~35%–60%)**: Deepens into stack mechanics—frames, prologues/epilogues, local variables, parameters—then buffer overflows and a first exploit, with per-architecture function layouts and canaries. Builds a C REPL and ports it to each architecture, culminating in a minimal botnet with a C2 and zombie REPL. - **Late (~60%–85%)**: (Excerpts do not detail this range.) Based on the book's stated scope, this is where reverse shells, droppers, worms, and port scanners are implemented across architectures. - **Ending (~85%–100%)**: (Excerpts do not cover the closing chapters.) Presumably consolidates porting lessons and deployment practice. 【Key Takeaways】 - **The same program, four times, is the pedagogical core** (Early): Implementing each project on x86_64, ARM, MIPS, and RISC-V forces you to see what is architecture-invariant (logic, syscall intent) versus what changes (registers, calling conventions, instruction encoding). - **Syscall conventions are the real portability boundary** (Early): The book tabulates conventions for x86_64, ARM32, AArch64, MIPS32/64, and RISC-V—knowing these is what lets low-level code move between machines. - **Stripping dependencies is a skill, not a trick** (Early): Dropping libc, choosing `_start` over `main`, controlling static vs. dynamic linking, and avoiding an executable stack are presented as deliberate engineering choices for constrained environments. - **Stack mechanics underpin both exploitation and defense** (Middle): Stack frames, prologues/epilogues, and per-architecture canary placement are taught concretely, then turned into a working buffer-overflow exploit. - **A REPL is a compact vehicle for architecture comparison** (Middle): Building a C REPL and porting it reveals jump instructions, processor flags, and buffer-initialization differences across all four architectures. - **Small components compose into a botnet** (Middle): A C2 REPL plus a zombie REPL plus deployment steps form a minimal botnet—showing how individually simple pieces combine into offensive infrastructure. - **Safe, contained Linux environments are the assumed lab** (Opening): All implementations are meant to run in isolated setups, reinforcing that this is controlled study, not live operation. 【Reading Tips】 - **Deep-read Part I** (chapters on binary/ASM/shellcode/stack): this is the foundation everything else builds on; skimming it will make later ports confusing. - **Pick one architecture as your "home"** (likely x86_64) and read its sections fully; skim the other three on first pass, then return when porting. - **Type and build every example**—the book's value is in the build/link/debug loop, not the prose. - **Treat the botnet/worm material as lab-only**; keep environments isolated and note the ethical framing. - **Use the per-architecture comparison tables as reference**, not narrative—bookmark the syscall-convention and stack-frame sections. 【Coverage Limits】 The excerpts are dominated by front matter and table of contents; the late chapters on reverse shells, droppers, worms, and port scanners are named in the blurb but not detailed in the sampled material, so this guide's late-stage descriptions are inferred from stated scope rather than excerpt content.