[IronShell-x86] Bare-metal x86 Shellcode Execution

Offensive Security
1

IronShell-x86 | Bare-metal x86 shellcode execution & analysis environment in pure 16-bit Assembly. 2-stage bootloader, TUI shell, 6 injectable payloads, sandbox layer with 4 enforcement policies, opcode scanning, IVT diffing & register integrity checks — all at ring 0, before any OS.

Architecture Language License Mode

First, Logic and Programming (Scheme) :sparkles:

Scheme
Scheme1920×2146 177 KB

:sparkles: Features

  • :hiking_boot: 2-Stage Bootloader — Stage 1 MBR loads Stage 2 + Sandbox + Shellcode from disk with retry logic
  • :desktop_computer: TUI Shell — Full interactive terminal UI with dual-panel VGA layout, command history, and live execution log
  • :syringe: 6 Injectable Payloads — MSGBOX, MEMWALK, PORTPROBE, STACKSMASH, NXPROBE, CPUINFO
  • :shield: Sandbox Layer — 4 enforcement policies, pre-execution opcode scanning, IVT snapshot diffing, register integrity checks
  • :microscope: Hardware Analysis — CPUID vendor/brand/feature detection, A20 gate test, conventional memory sizing
  • :gear: Clean Build System — NASM + QEMU Makefile with GDB debug stub, ndisasm disassembly, and binary size validation

:syringe: Payload Reference

# Name Description Risk
0 MSGBOX Constructs a PIC stub at 0xA000 and executes it :white_check_mark: Safe
1 MEMWALK Walks and dumps the BIOS Data Area (0x0400+) :white_check_mark: Safe
2 PORTPROBE Samples 8 I/O ports starting at 0x03F8 via IN :white_check_mark: Safe
3 STACKSMASH Writes canary pattern to stack and verifies integrity :warning: Caution
4 NXPROBE Tests NX/DEP enforcement by executing a RET stub :white_check_mark: Safe
5 CPUINFO Full CPUID enumeration — vendor, brand, stepping, SSE/AVX :white_check_mark: Safe

:package: Installation

1. Clone the repository

git clone https://github.com/tc4dy/ironshell-x86.git
cd ironshell-x86

2. Install dependencies

sudo apt install nasm qemu-system-x86

3. Build and run

make
make run

:rocket: Usage

make              # Build all binaries and assemble disk image
make run          # Launch in QEMU (terminal/curses mode)
make run-sdl      # Launch in QEMU (SDL window)
make debug        # Launch with GDB stub on port :1234
make disasm       # Disassemble all binaries via ndisasm
make clean        # Remove all build artifacts
make help         # Show full build reference

:desktop_computer: Shell Commands

Once booted in QEMU, the interactive shell accepts:

Command Description
list List all available payloads with index and risk flag
sel <n> Select a payload by index number
run Execute the currently selected payload
sandbox Re-run all sandbox environment checks
dump <hex> Hexdump 32 bytes at a given memory address
info Display system memory layout and load addresses
clear Clear the execution log panel
help Show full command reference

:warning: Requirements

  • nasm — Netwide Assembler
  • qemu-system-i386 — x86 system emulator
  • ndisasm (optional) — for make disasm, included with NASM

:file_folder: File Structure

ironshell-x86/
├── loader.asm      Stage 1 MBR — disk loader, VGA boot UI
├── stage2.asm      Execution engine, TUI shell, payloads
├── sandbox.asm     Protection layer, policy engine, IVT diffing
└── Makefile        Build, run, debug, disasm targets
1 Like