nerdexam
EC-CouncilEC-Council

312-49 · Question #274

312-49 Question #274: Real Exam Question with Answer & Explanation

The correct answer is B: 24 bytes. In Linux exploit development, the smallest functional shellcode — typically one that spawns a shell via the execve('/bin/sh') syscall on x86 — is classically cited as 24 bytes. This is a well-known benchmark in shellcode writing: it represents the minimum number of bytes need

Submitted by cyberguy42· Apr 18, 2026Malware Forensics

Question

In Linux, what is the smallest possible shellcode?

Options

  • A8 bytes
  • B24 bytes
  • C800 bytes
  • D80 bytes

Explanation

In Linux exploit development, the smallest functional shellcode — typically one that spawns a shell via the execve('/bin/sh') syscall on x86 — is classically cited as 24 bytes. This is a well-known benchmark in shellcode writing: it represents the minimum number of bytes needed to invoke the execve system call with the correct arguments using compact x86 assembly. 8 bytes is too small to encode a meaningful syscall sequence. 80 and 800 bytes are far larger than the minimum. The 24-byte shellcode is a standard reference in exploit development courses and literature.

Topics

#Shellcode#Linux#Exploit Development#Assembly

Community Discussion

No community discussion yet for this question.

Full 312-49 PracticeBrowse All 312-49 Questions