How should stack strings be initialized in C shellcode? - c

Question

I'm trying to optimize my shellcode project by introducing a method to store strings as unit64_t values in an array. The shellcode project is written without any optimizations (Debug only) as I want to control everything at the opcode level i.e., the shellcode has precomputed offsets to local variables. If /O2 optimizations were enabled, it might rearrange the C shellcode and mess things up?
For example, currently the shellcode has these stack arrays defined
char calc[] = { 'c','a','l','c','.','e','x','e',0 };
char winexec[] = { 'W','i','n','E','x','e','c',0 };
char sleep[] = { 'S','l','e','e','p',0 };
char createtoolhelp32snapshot[] = { 'C','r','e','a','t','e','T','o','o','l','h','e','l','p','3','2','S','n','a','p','s','h','o','t',0 };
char process32first[] = { 'P','r','o','c','e','s','s','3','2','F','i','r','s','t',0 };
char process32next[] = { 'P','r','o','c','e','s','s','3','2','N','e','x','t',0 };
char closehandle[] = { 'C','l','o','s','e','H','a','n','d','l','e',0 };
char openprocess[] = { 'O','p','e','n','P','r','o','c','e','s','s',0 };
char virtualallocex[] = { 'V','i','r','t','u','a','l','A','l','l','o','c','E','x',0 };
char virtualfreeex[] = { 'V','i','r','t','u','a','l','F','r','e','e','E','x',0 };
char writeprocessmemory[] = { 'W','r','i','t','e','P','r','o','c','e','s','s','M','e','m','o','r','y',0 };
char createremotethread[] = { 'C','r','e','a','t','e','R','e','m','o','t','e','T','h','r','e','a','d',0 };
char comparestringa[] = { 'C','o','m','p','a','r','e','S','t','r','i','n','g','A',0};
char notepad[] = { 'n','o','t','e','p','a','d','.','e','x','e',0 };
char getcurrentprocessid[] = { 'G','e','t','C','u','r','r','e','n','t','P','r','o','c','e','s','s','I','d',0 };
char exitthread[] = { 'E','x','i','t','T','h','r','e','a','d',0 };
The generated assembly is
52: char calc[] = { 'c','a','l','c','.','e','x','e',0 };
00007FF6248B1C6D C6 45 08 63 mov byte ptr [calc],63h
00007FF6248B1C71 C6 45 09 61 mov byte ptr [rbp+9],61h
00007FF6248B1C75 C6 45 0A 6C mov byte ptr [rbp+0Ah],6Ch
00007FF6248B1C79 C6 45 0B 63 mov byte ptr [rbp+0Bh],63h
00007FF6248B1C7D C6 45 0C 2E mov byte ptr [rbp+0Ch],2Eh
00007FF6248B1C81 C6 45 0D 65 mov byte ptr [rbp+0Dh],65h
00007FF6248B1C85 C6 45 0E 78 mov byte ptr [rbp+0Eh],78h
00007FF6248B1C89 C6 45 0F 65 mov byte ptr [rbp+0Fh],65h
00007FF6248B1C8D C6 45 10 00 mov byte ptr [rbp+10h],0
53: char winexec[] = { 'W','i','n','E','x','e','c',0 };
00007FF6248B1C91 C6 45 38 57 mov byte ptr [winexec],57h
00007FF6248B1C95 C6 45 39 69 mov byte ptr [rbp+39h],69h
00007FF6248B1C99 C6 45 3A 6E mov byte ptr [rbp+3Ah],6Eh
00007FF6248B1C9D C6 45 3B 45 mov byte ptr [rbp+3Bh],45h
00007FF6248B1CA1 C6 45 3C 78 mov byte ptr [rbp+3Ch],78h
00007FF6248B1CA5 C6 45 3D 65 mov byte ptr [rbp+3Dh],65h
00007FF6248B1CA9 C6 45 3E 63 mov byte ptr [rbp+3Eh],63h
00007FF6248B1CAD C6 45 3F 00 mov byte ptr [rbp+3Fh],0
To improve performance, should those arrays be replaced with
uint64_t calc[] = { 0x6578652e636c6163, 0x0000000000000000 };
uint64_t winexec[] = { 0x00636578456e6957 };
uint64_t sleep[] = { 0x0000007065656c53 };
uint64_t createtoolhelp32snapshot[] = { 0x6f54657461657243, 0x3233706c65686c6f, 0x746f687370616e53, 0x0000000000000000 };
uint64_t process32first[] = { 0x33737365636f7250, 0x0000747372694632 };
uint64_t process32next[] = { 0x33737365636f7250, 0x0000007478654e32 };
uint64_t closehandle[] = { 0x6e614865736f6c43, 0x0000000000656c64 };
uint64_t openprocess[] = { 0x636f72506e65704f, 0x0000000000737365 };
uint64_t virtualallocex[] = { 0x416c617574726956, 0x00007845636f6c6c };
uint64_t virtualfreeex[] = { 0x466c617574726956, 0x0000007845656572 };
uint64_t writeprocessmemory[] = { 0x6f72506574697257, 0x6f6d654d73736563, 0x0000000000007972 };
uint64_t createremotethread[] = { 0x6552657461657243, 0x6572685465746f6d, 0x0000000000006461 };
uint64_t comparestringa[] = { 0x53657261706d6f43, 0x000041676e697274 };
uint64_t notepad[] = { 0x2e64617065746f6e, 0x0000000000657865 };
uint64_t getcurrentprocessid[] = { 0x6572727543746547, 0x7365636f7250746e, 0x0000000000644973 };
uint64_t exitthread[] = { 0x6572685474697845, 0x0000000000006461 };
The generated assembly is
71: unsigned long long calc[] = { 0x6578652e636c6163, 0x0000000000000000 };
00007FF7EF7C1C5C 48 B8 63 61 6C 63 2E 65 78 65 mov rax,6578652E636C6163h
00007FF7EF7C1C66 48 89 45 08 mov qword ptr [calc],rax
00007FF7EF7C1C6A 48 C7 45 10 00 00 00 00 mov qword ptr [rbp+10h],0
72: unsigned long long winexec[] = {0x00636578456e6957};
00007FF7EF7C1C72 48 B8 57 69 6E 45 78 65 63 00 mov rax,636578456E6957h
00007FF7EF7C1C7C 48 89 45 38 mov qword ptr [winexec],rax
Question
The shellcode works correctly with both definitions but is the extra performance worth degrading the readability?
Tool
https://godbolt.org/z/eYhWPG9E6