Which shellcode evasion method encodes the payload and uses a decoder to rewrite the shellcode on every transmission?

Which shellcode evasion method encodes the payload and uses a decoder to rewrite the shellcode on every transmission?

• A. Polymorphic shellcode attacks
• B. ASCII shellcodes
• C. Pre-Connection SYN
• D. Fragmentation

Answer: (A)

Polymorphic shellcode evasion relies on encoding or encrypting the payload and supplying a decoder that reconstructs the original shellcode at execution. Each delivery mutates both the encoded payload and the decoder so that the resulting byte sequence looks different every time, while the actual actions of the shellcode remain the same. This mutation helps defeat signature-based detection because there isn’t a fixed fingerprint to match across transmissions—the decoder rewrites the shellcode on each run, producing a fresh variant that still delivers the payload. ASCII shellcodes encode data using printable ASCII characters to fit certain constraints, but they don’t inherently involve mutating a decoder to rewrite the payload on every transmission. Pre-Connection SYN and fragmentation are network-level evasion techniques aimed at bypassing defenses or splitting traffic, not specifically about encoding the payload with a runtime decoder that regenerates the shellcode on each delivery.

Polymorphic shellcode evasion relies on encoding or encrypting the payload and supplying a decoder that reconstructs the original shellcode at execution. Each delivery mutates both the encoded payload and the decoder so that the resulting byte sequence looks different every time, while the actual actions of the shellcode remain the same. This mutation helps defeat signature-based detection because there isn’t a fixed fingerprint to match across transmissions—the decoder rewrites the shellcode on each run, producing a fresh variant that still delivers the payload.

ASCII shellcodes encode data using printable ASCII characters to fit certain constraints, but they don’t inherently involve mutating a decoder to rewrite the payload on every transmission. Pre-Connection SYN and fragmentation are network-level evasion techniques aimed at bypassing defenses or splitting traffic, not specifically about encoding the payload with a runtime decoder that regenerates the shellcode on each delivery.