README

ExecuteShellcode-Delphi

This repository demonstrates memory allocation and execution techniques in Delphi, showcasing Windows API interaction for dynamic memory management and code execution.

Overview

This Delphi console application demonstrates a basic shellcode execution technique. It uses a simple XOR-encrypted x64 shellcode that launches calc.exe as a proof of concept, implementing the fundamental pattern used for in-memory code execution.

This Delphi console application demonstrates:

• Memory allocation using VirtualAlloc
• Process memory writing with WriteProcessMemory
• Memory protection modification via VirtualProtect
• Thread creation and execution using CreateThread
• Basic XOR encryption/decryption implementation

Technical Details

The application performs the following operations:

1. Defines an encrypted payload (in this case, an encrypted x64 calc.exe shellcode)
2. Allocates executable memory in the current process
3. Decrypts the payload using XOR operation
4. Copies the decrypted code to the allocated memory
5. Changes memory protection to allow execution
6. Creates a thread to execute the code
7. Waits for execution to complete

Code Structure

• OBXOR - Simple XOR encryption/decryption function
• ExecutePayload - Core function handling memory operations and execution
• Main - Entry point demonstrating the execution flow

Building the Project

Requirements

• Delphi 10.x or newer
• Windows operating system

Compilation

1. Open the project in Delphi IDE
2. Make sure to select the 64-bit Windows platform (x64)
3. Build the project

Security Considerations

This code demonstrates techniques that could potentially be flagged by security software. Key security aspects to understand:

• Memory allocation with executable permissions
• Self-modifying code concepts
• Process memory manipulation
• Thread execution of dynamically allocated code

Disclaimer

This code is provided as-is without warranty of any kind. The author is not responsible for any misuse or damage caused by this code. This repository is intended for educational purposes and cybersecurity research.