Shellcode Chunking (Short Jumps)

Updated 13 Sep 2026

•
What it is
- •
  Split shellcode across byte ranges that survive a known corruption pattern, using short jumps to skip the overwritten ranges.
•
How it works
- •
  Send a first probe payload (or read the challenge's own disassembly dump) to learn the corruption pattern: which byte ranges get overwritten and with what value.
- •
  Lay out real instructions only inside the clean ranges. Fill each clean range's leftover space with NOPs so instruction boundaries don't accidentally straddle into a range that's about to be clobbered.
- •
  Use a two-byte short jump to bridge each gap. Its signed displacement is measured from the instruction after the jump.
- •
```
Clean chunk A: [ instructions ][ jump to C ]
Corrupted chunk B: [ skipped bytes ]
Clean chunk C: [ more instructions ]
```
•
When to use it
- •
  Use this when the harness discloses or consistently applies a fixed pattern of overwritten byte ranges.
- •
  Landing in bytes overwritten with 0xCC triggers int3/SIGTRAP, helping identify a bad jump target.
•
Examples
- •
  If bytes 10–19 are overwritten, place a jump in the first clean chunk that lands at byte 20. Keep complete instructions inside clean ranges.

pwntools

print(disasm(shellcode))
print(hexdump(shellcode))  # Check chunk boundaries and jump targets.

x/50xb $rip  # Locate overwritten and surviving ranges.