It doesn’t really even have to be a real challenge-response since the server controls the shellcode. Just have the shellcode unconditionally submit something (m

It doesn’t really even have to be a real challenge-response since the server controls the shellcode. Just have the shellcode unconditionally submit something (maybe a value that requires a minimum amount of computation or WinAPI sanity checks). If you don’t run that bit of code, down comes the ban hammer.