Well, this is where we left off in the previous video.
Let's copy our current working version of Reverse Qualified, which is The Darkness on Fire, and let's
save it as reverse dash DCPI Dash Opt Dart Nazeem.
Now let's work on this file.
Reverse dash, DCP Dash Orbed Darwinism, where we are going to write some optimized code.
All right.
So let's scroll down.
We can now remove all these comments.
We don't need them anymore.
There it is.
Let's scroll down so these doctor calls are where we have some redundant instructions, let's first
come in all these calls and let's write a simple loop to actually optimize this called.
All right, so what I'll do is I will just use that ATX, ATX to start with and I will also are Odissi
and then I will just add
two to this RSA register.
So we are initializing Odissi with the value to now when we want one, we can simply document it.
And again, when we want zero in RSA register, we can just simply document autosite.
Right.
So now what I want to do is I want to set up a loop here so the loop will actually move.
This is called number every time we want to execute dukedom.
So first we are just moving the value Planetree into Orteig Register.
Instead of moving, we can use add and then we can write this call here.
If you notice this loop, this idea is going to contain thirty three for the first time.
But for the second time, Auriga may contain some value and we are just adding 33 to it.
So it's a good idea to actually zero out inside this loop.
So let's use our are our eggs and let's probably remove this here.
All right.
So we have autosite, which is actually initialized with the value to after that.
Every time we are inside the loop, we are just adding 33 to our eggs.
Register on the register already contains the first argument, which is the target file descriptor.
So we don't have to worry about that.
The second argument for the first time is going to contain two, so it executes the error.
Once that is done, we are going to use decrement autosite.
So this is going to make the RSA value one.
That's the right value for Doob to call for study out after documenting the value of our site, let's
execute Jeunesse.
What this instruction will do is it will take a short jump if same flag is not set.
What it means is when this decrement RSA instruction is executed for the first time, I decide becomes
two.
So that won't set the same flag because it won't produce any negative value.
So we are just going to take the loop.
So when the loop is taken, we go here, we come back, we set up this is called value and execute this
call with the RSA value one.
So after that, we are going to be recommend Oddisee once again, which is going to make it zero.
Zero is the value we will need for Doob to call for SJT in.
Once again, the same flag is not set, so we are going to take the loop.
So this time this call is going to be executed for Estulin.
Once that is done, we are going to decrement RSA once again.
We are diclemente zero this time, which is going to cause the same flag to be set.
If same flag is set, this loop is not going to execute anymore.
So we will break out of the loop and we have executed all three to two goals with this simple loop.
Let's quickly check our program.
I'm just going to save the file and let's assemble and link it.
DCB Dash Opt.
Similarly here, DCP Dash Opt.
Let's also link it using L.E.
Caulked.
Part.
All right, let's first check if the program itself is working fine or not,
and the national repeat four four four four and executed reverse Nash Tsipi, Nash Oct.
There it is, looks like our program is working fine now.
Let's quickly check if it has animal rights once again, object dump bash deep and it was Dash Tsipi
Dash upped the dash cam and I don't see any nail.
No, let's compare the length of the skin caught in the reverse dash DCP file and the reverse dash to
speed up time.
So I'm going to use this one liner once again.
Let me just copy this and let's start here.
And instead of binary, let's use reverse dash DCP here.
There it is.
Let's also use reverse dash.
Dash won't look at that.
The length of the shell cord is significantly reduced in the optimized cord.
So this should give you an idea of how we can reduce the length of the shell cord, because sometimes
we may have to deal with the space issues as well when writing exploits.
So we may want to have some shorter shell cord.
So this is how we can reduce the shell cord by removing redundant instructions in the assembly program.
So I'm just copying the shell cord.
And let's quickly check if it works, we don't exploit I'm going to Xixi directly where we have our
exploit dash final and let's once again command it out and let's use called.
And it's past the corporate shell called.
All right, now let's save the file and let's start at Lisner.
And let's try to execute our exploit, not exploit Nasch final card, let's pipe it and execute not
111.
Look at that, we have gotten out of a shell.
This is how we can write Shell called for Intel 64 bit processors.
I hope the overall process of encored creation is clear enough.
You can write any shell code in a similar fashion.
And that brings us to the end of writing.
Shell called.