MAL Donut PIC Shellcode

Matt Brady@mbrady5299

•updated Aug 14, 2025•1•0•18

Detects a position-independent code (PIC) technique commonly used in shellcode, such as that generated by the Donut tool. This technique uses a 'call $+5' followed by a 'pop' to determine the current instruction pointer's address.