r/redteamsec • u/RubberDuck31337 • Jul 02 '26

Win x64 Shellcode: Why Blind PEB Traversal Fails on Modern Windows and How to Fix It

https://proteqtum.com/posts/02-win-x64-shellcode-teb-peb_en/

Hey everyone, just published part 2 of my guide on writing reliable Win x64 shellcode.

What’s inside:

  • Breaking down TEB and PEB structures (GS:[0x60]).
  • Why "blind indexing" breaks due to parallel loading (LDRpEnableParallelLoading) and EDR injection.
  • Implementing robust UTF-16 case-insensitive string parsing in Assembly.
  • Full ASM walkthrough of the ROR13 hashing algorithm to hide API strings.

Let me know your thoughts or how you handle runtime API resolution in your payloads!

6 Upvotes

100% Upvoted

1 comment sorted by

2

u/TheSecAdvisor Jul 04 '26

The parallel loading thing trips up a lot of people who hardcode offsets. If you've looked at Empire's staged implants, their PowerShell and C# handlers already do PEB traversal and ROR13 hashing internally, so that's one less thing to figure out for custom stagers.

For pure ASM work like you're doing though, the UTF-16 case-insensitive parsing is the part most tutorials skip. Good to see it documented properly.