In Linux, what is the smallest possible shellcode?

In Linux, what is the smallest possible shellcode?

• A. 24 bytes
• B. 80 bytes
• C. 8 bytes
• D. 800 bytes

Answer: (A)

In Linux on 32-bit x86, spawning a shell with shellcode is all about making a single execve system call with the right arguments, while keeping the code compact and free of null bytes. To run a shell you need the path to the shell (the string "/bin/sh"), an argv array that points to that string, and an envp pointer (often NULL). The kernel expects the syscall number in EAX, the filename in EBX, the argv pointer in ECX, and the envp pointer in EDX, followed by triggering the interrupt that invokes the kernel (int 0x80). By placing "/bin/sh" on the stack, constructing a minimal argv array, zeroing out envp, and then issuing the syscall, you can achieve this in a tightly packed sequence. With careful instruction encoding to avoid zero bytes, this can be done in as little as 24 bytes, which is why 24 bytes is cited as the smallest practical shellcode for this task. The other sizes don’t fit because 8 bytes isn’t enough to place the shell path, set up the argv/envp structure, and perform the syscall; 80 bytes adds unnecessary instructions beyond the minimal logic, and 800 bytes is far larger than needed for just spawning a shell.

In Linux on 32-bit x86, spawning a shell with shellcode is all about making a single execve system call with the right arguments, while keeping the code compact and free of null bytes. To run a shell you need the path to the shell (the string "/bin/sh"), an argv array that points to that string, and an envp pointer (often NULL). The kernel expects the syscall number in EAX, the filename in EBX, the argv pointer in ECX, and the envp pointer in EDX, followed by triggering the interrupt that invokes the kernel (int 0x80). By placing "/bin/sh" on the stack, constructing a minimal argv array, zeroing out envp, and then issuing the syscall, you can achieve this in a tightly packed sequence. With careful instruction encoding to avoid zero bytes, this can be done in as little as 24 bytes, which is why 24 bytes is cited as the smallest practical shellcode for this task.

The other sizes don’t fit because 8 bytes isn’t enough to place the shell path, set up the argv/envp structure, and perform the syscall; 80 bytes adds unnecessary instructions beyond the minimal logic, and 800 bytes is far larger than needed for just spawning a shell.