# Analyzing Position Independent Code

> Analyzes position-independent code and shellcode by identifying GetPC/PEB-walk

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-position-independent-code`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/analyzing-position-independent-code
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-position-independent-code
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Analyzing Position-Independent Code

## When to Use

- You have a PIC blob/shellcode that resolves its own addresses and APIs without imports, and you
  need to understand its technique before disassembly.
- You want to identify the base-resolution (GetPC), PEB-walk, and API-hashing mechanics.

**Do not use** this to execute the code — analyze it statically (and emulate separately if needed).
Treat the blob as malicious.

## Prerequisites

- The PIC/shellcode blob (read inertly).

## Safety & Handling

- Read bytes statically; store the blob password-protected and never execute it.

## Workflow

### Step 1: Identify PIC techniques

```bash
python scripts/analyst.py analyze shellcode.bin
```

Detects GetPC stubs (`call $+5`/`fnstenv`), PEB access (`fs:[30]`/`gs:[60]`), API-hash loops
(`lodsb` + `ror`), and stack-string construction.

### Step 2: Determine architecture and base behavior

Confirm 32- vs 64-bit PEB access and how the code computes its own base for relative addressing.

### Step 3: Map API resolution

Note the hashing algorithm and that resolved APIs are obtained by walking the PEB→LDR→export tables
(pair with the API-hash resolver skill).

### Step 4: Disassemble at the right base

Load the blob at the inferred base/entry in a disassembler/emulator and proceed.

## Validation

- PIC technique hits reference real patterns (GetPC/PEB/API-hash), not arbitrary bytes.
- Architecture is consistent with the PEB-access form detected.
- The analysis points to a concrete entry/base for disassembly.

## Pitfalls

- Encoded/staged shellcode where the PIC patterns appear only after decoding.
- Mixed 32/64-bit (WoW64) transitions.
- Custom GetPC variants not matching common signatures.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
- PEB/LDR and ATT&CK T1027.007 references (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-analyzing-position-independent-code
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.