egghunter

An egghunter is a small piece of exploit code designed to locate a larger payload elsewhere in a process's memory and transfer execution to it. It is used in exploitation scenarios where the available space for a shellcode stub is limited, necessitating that the main payload reside elsewhere in memory.

The egghunter operates by scanning process memory for a pre-arranged marker that tags the location of the payload. When the marker is found, control is transferred to the payload. Because memory layout and protections vary by operating system and architecture, egghunters are typically highly OS- and architecture-specific and rely on low-level memory access techniques.

In practice, an exploit might place the marker in memory along with the payload, and deploy a compact egghunter within the vulnerable input. The egghunter remains small to fit tight constraints, while the payload can be larger and more complex.

Security relevance: Egghunter concepts are discussed in vulnerability research and exploit development literature. Modern defenses such as address space layout randomization (ASLR), memory protection mechanisms, and monitoring reduce the effectiveness of such techniques. Responsible disclosure and ethical testing considerations apply when researching or studying these methods.