Assembly (x86/x64) for hooks & shellcode
Must-know
- Windows x64 calling convention (RCX,RDX,R8,R9, stack shadow)
- RIP-relative addressing; PIC shellcode constraints
- Trampoline construction; register clobber lists
- Syscall stubs; wow64 transitions
Workflow
- Write in asm or compile C then carve
- Validate disassembly in target context
- Test under DEP/CFG/CET constraints
Pair with
assembly-reversal-engineering, stealth-injectors, zydis-disassembly-engineering if present.