# Executing Shellcode with Inline Assembly in C/C++

It's possible to execute shellcode inline in a C/C++ program. The reason why it's good to have this technique in your arsenal is because it does not require you to allocate new `RWX` memory to copy your shellcode over to by using `VirtualAlloc` API which is heavily monitored by EDRs and can get you caught. Instead, the code will get embedded into the PE's `.TEXT` section which is executable by default as this is where the rest of your application's code resides.

## Execution

Install mingw - I'm doing it via chocolatey pacakge manager:

```csharp
choco install mingw
```

Create a simple C program that includes the shellcode. In my case, I'm simply adding 4 NOP instructions and prior to that, I am printing out the string `spotless`, so I can easily identify the shellcode location when debugging the program:

{% code title="inline-shellcode.c" %}

```cpp
#include <Windows.h>
#include <stdio.h>

int main() {
	printf("spotless");
    asm(".byte 0x90,0x90,0x90,0x90\n\t"
		"ret\n\t");
	return 0;
}
```

{% endcode %}

Let's compile and link the code:

```csharp
gcc -c .\inline-shellcode.c -o main.o; g++.exe .\main.o -o .\main.exe
```

Debugging the code via xdbg, we can see where the string `spotless` is going to be printed out and straight after it, we have the 4 NOP instructions:

![](/files/-LksmzZsiGWinNTkjszV)

## References

{% embed url="<https://github.com/Mr-Un1k0d3r/Shellcoding>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-inline-assembly-in-c-c++.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.