Wild West Hackin' Fest - Deadwood 2024

Jigsaw is a shellcode obfuscation routine designed to hide your shellcode without requiring the use of encryption routines. Jigsaw works by generating an array (positions[]) the size of your shellcode and populates the array with random numbers, each representing a unique position in the original shellcode array. Jigsaw then creates a new shellcode array, jigsaw[], by iterating through the array of randomized positions. If first entry of the randomized positions array (positions[0]) is 100, then Jigsaw selects the byte at shellcode[100] and inserts it into jigsaw[0]. Jigsaw repeats this process until all shellcode bytes have been populated to the jigsaw[] array. While this tool is new, our testing indicates very few AV/EDR are aware of this technique. As a result, this technique could be an effective part of your shellcode loader arsenal.