Jigsaw: Scramble Your Shellcode, Reassemble at Runtime

by Jason Downey

Encryption feels like the obvious move against shellcode detection, but it really just trades one problem for another. Sure, the recognizable patterns disappear. But now you’ve got a suspicious looking blob sitting on disk, and the routine that unpacks it at runtime has its own fingerprint that security tools have seen a thousand times. Change the key and nothing really changes. Swap the algorithm and you’re still shipping something scanners already know how to spot. You’re playing whack-a-mole with detection, and the moles are winning. Jigsaw takes a completely different approach. Instead of encrypting your shellcode, it shuffles the bytes into a random order and generates a lookup table to put them back together at runtime.

Feed Jigsaw a raw shellcode file and it outputs three things. The randomized shellcode array, a positions array that maps each byte back to where it actually belongs, and a C/C++ stub that reconstructs the payload in memory before execution. The reconstruction loop is dead simple. For each index in the positions array, take the byte from the jigsaw array and put it in the right spot. A few lines of C and your shellcode is reassembled.
python3 jigsaw.py payload.bin

Think of it like dumping a finished jigsaw puzzle into a bag, shaking it up, and handing someone the loose pieces along with a numbered cheat sheet that says “piece 47 goes in slot 1, piece 203 goes in slot 2” and so on. Without that cheat sheet, it’s a pile of disconnected pieces that don’t form any recognizable picture. That’s what AV/EDR sees sitting on disk. At runtime, the reconstruction loop reads the map and snaps everything back into place. The puzzle is only complete in memory, never on the filesystem.

The output looks nothing like the original shellcode statically. If your raw shellcode normally starts with 0xfc 0x48 0x83 0xe4, after Jigsaw those bytes are scattered randomly across the array. There are no recognizable byte sequences for signature-based detection to latch onto. The reconstruction only happens in memory at runtime, keeping the on-disk artifact clean.

Why This Works

Most signature-based detections look for known byte patterns in shellcode. Encrypted shellcode defeats those patterns but creates a new problem because encryption makes the entropy jump. Jigsaw doesn’t change the bytes themselves, just their order. The entropy stays roughly the same as the original, but the byte pattern is completely destroyed. In the eyes of a signature scanner, it’s just a random-looking blob of data that doesn’t match anything in its database.

Part of Mike Saunders’ shellcode obfuscation research at Red Siege, Jigsaw pairs well with other tools from the same toolkit. Run your shellcode through Jigsaw for pattern destruction, then use DigDug to inflate the final binary past scanning thresholds. Layered evasion is always better than relying on a single trick.

About Jason Downey, Security Consultant 

Jason Downey has over ten years of professional experience in IT and information security ranging in a variety of roles in network security roles with additional experience in systems administration. Jason has spoken in front of various audiences ranging from youth initiatives to major security conferences, while creating informational content on SiegeCasts and forward-facing marketing channels. Jason excels at a variety of penetration testing tactics and is well known for his vishing and social engineering expertise.

Certifications:
CRTO, GPEN, GCIH, CCNA R&S, CCNA Security, CEH, CHFI