In a DEFCON 30 talk presented by Hadrien Barral and Georhes-Axel Jaloyan, the researchers presented a novel way of using emojis to inject shellcode into vulnerable applications. Emojis are the faces, flags, and tiny images included in the UTF-8 text encoding standard that are made up of a string of bytes. Since assembly code, the machine code that is run by the computer, is just a sequence of bytes, code can be expressed as a set of characters, or in this case, emojis. Shellcode is the set of characters that, when executed as code, runs a program that often grants a “shell,” or a command line interface, to the attacker. Typically, this character sequence uses single letter assembly instructions to create the malicious program, though it is not so simple most of the time. The researchers set a goal of compiling assembly code using emojis to a constrained instruction set that does not have single character instructions or other helpful features. When creating shellcode with letters, the character “A”, 0x41 in hexadecimal, represents the assembly instruction “inc %eax” (increment the EAX register). Emojis, on the other hand, are much larger. For example, the “Red Question Mark” emoji “❓” is 0xE29D93 in hexadecimal and does not represent any one instruction. The researchers discovered that two (2) emojis, when placed next to each other in a pair, represent one (1) or multiple instructions creating a “gadget” that can be reused. By building all of the possible gadgets ahead of time, the researchers have a library of code snippets used to create malicious shellcode. The emoji gadgets are chained together to create a malware packer, code that contains an arbitrary encoded payload and executes it. Using this framework, the researchers were able to successfully inject emoji-based shellcode into a vulnerable C application in a demo environment. While this technique may not be used in many circumstances today, many programs do not handle emojis well, potentially leading to new vulnerabilities being discovered. The researchers themselves experienced many issues working with and displaying emojis in popular applications while creating this new technique. Both the target computer, and a printer that the researchers deployed their emoji shellcode to, suffered catastrophic failures. According to Hadrien and Georhes-Axel, the printer was so negatively impacted that it required a factory reset. More information can be found in the article below, as well as the researcher’s GitHub repository. A video of their talk will be uploaded to YouTube in the coming weeks. This attack vector represents yet another novel approach that threat actors may take in accomplishing their objectives.