Jargon & Jigsaw: Shellcode Obfuscation | Mike Saunders

Entropy and EDR Detection

Mike Saunders of Red Siege explains shellcode obfuscation through information-theory entropy. High-entropy payloads resist compression and often trigger EDR heuristics; encrypted shellcode therefore looks suspicious even when hidden inside loaders.

The Jargon Technique

His Jargon tool encodes shellcode as sequences of English words drawn from a large dictionary, dramatically lowering measured entropy. In demos, an AES-encrypted loader (~362 KB) barely compresses, while the same loader with an embedded word array balloons to ~15 MB yet compresses the dictionary by ~65%—signaling low randomness to static analysis.

Design Rationale

Saunders coined "jargon" deliberately: specialized vocabulary that obscures meaning from outsiders, analogous to how word-encoded shellcode confuses defensive tools. He notes parallel ideas (including emoji-encoded shellcode presented elsewhere) but positions Jargon as published open tooling.

Jigsaw and Takeaways

The talk also covers companion Jigsaw obfuscation approaches. Saunders urges defenders to understand that compressibility and entropy metrics can be gamed, and that creative encodings may bypass simplistic high-entropy detection without relying on traditional encryption alone.