Ascii shellcode

You can use the alpha3 tool, which produces ascii shellcode that includes an encoder — it uses its own encoder to decode. The resulting shellcode is very short, but this kind of shellcode needs a reg pointing to the start of the shellcode.

Some other variants xor by offset and finally jmp esp to execute.

Here’s a write-up of one challenge’s solution:

Use a position on the stack together with a ROP ret to jump to that position, then xor the values on the stack against eax, using op codes like xor al,[esp+0x34]; the offset part is padded with push eax, so that eax ends up pointing exactly at our shellcode’s location.

See the references below.

References

http://inaz2.hatenablog.com/entry/2014/07/11/004655
http://inaz2.hatenablog.com/entry/2014/07/12/000007
http://inaz2.hatenablog.com/entry/2014/07/13/025626
https://code.google.com/archive/p/alpha3/
https://nets.ec/Ascii_shellcode