{"enrichment":{"faq":[{"a":"Shellcode-dev teaches position-independent code construction by leveraging PEB (Process Environment Block) walking to dynamically resolve Windows APIs without hardcoded addresses. The skill covers ROR13 hashing for API name obfuscation, null-byte elimination techniques, and x86/x64 architecture patterns. This approach ensures your shellcode runs reliably across different process memory layouts and Windows versions.","q":"How to write position independent shellcode?"},{"a":"Shellcode-dev addresses detection evasion through multiple injection alternatives: early bird APC injection, threadless hook-based injection, pool party thread pool techniques, and mockingjay RWX section abuse. It also covers indirect syscalls, hell's gate runtime SSN resolution, and halo's gate hooked syscall recovery\u2014all designed to bypass EDR monitoring of traditional CreateRemoteThread calls.","q":"What does shellcode-dev cover for loader evasion?"},{"a":"Shellcode-dev includes PE-to-shellcode conversion guidance, referencing tools like Donut for transforming compiled binaries into position-independent shellcode. This enables delivery of full applications through shellcode loaders while maintaining evasion properties and cross-platform compatibility.","q":"Can shellcode-dev convert PE files to shellcode?"},{"a":"Shellcode-dev covers polymorphic encoder patterns and metamorphic self-modifying code strategies for dynamic evasion. These techniques alter shellcode structure at runtime to defeat signature-based detection while preserving functionality across execution contexts.","q":"What polymorphic and metamorphic techniques does shellcode-dev teach?"},{"a":"Shellcode-dev extends beyond Windows to cover cross-platform shellcode development for Linux and macOS, adapting PEB-walking and API-hashing concepts to Unix-like syscall conventions and loader mechanisms.","q":"Does shellcode-dev support non-Windows platforms?"}],"shadow_tags":["memory-injection","anti-evasion","process-hollowing","syscall-obfuscation","runtime-encoding","thread-hijacking","sandbox-detection","code-polymorphism","windows-internals","edr-bypass"],"summary_rewrite":"Shellcode-dev guides you through building position-independent code for implant delivery, covering PEB walking for API resolution, ROR13 hashing, and null-byte elimination. It includes loader patterns, PE conversion tools, and evasion strategies for bypassing static detection across Windows, Linux, and macOS platforms."},"files":[{"bytes":18565,"path":"skills/shellcode-dev/SKILL.md","sha256":"05c14c864991a506c5e205a9890ffe03a8325da1da9d06f38a8338e37769e6a1","url":"https://skillfed.io/files/hypnguyen1209/offensive-claude/shellcode-dev/a89fe2b4/SKILL.md"}],"id":"hypnguyen1209/offensive-claude/shellcode-dev","links":{"html":"https://skillfed.io/hypnguyen1209/offensive-claude/shellcode-dev","md":"https://skillfed.io/hypnguyen1209/offensive-claude/shellcode-dev.md","repo":"https://github.com/hypnguyen1209/offensive-claude"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":58,"language":"Python","last_updated":"2026-07-03","license":"MIT","name":"shellcode-dev","publisher":"hypnguyen1209","stars":326},"relations":{"similar":[{"id":"hypnguyen1209/offensive-claude/edr-evasion"},{"id":"wshobson/agents/binary-analysis-patterns"},{"id":"mohitmishra786/low-level-dev-skills/assembly-x86"},{"id":"yaklang/hack-skills/anti-debugging-techniques"},{"id":"yaklang/hack-skills/stack-overflow-and-rop"},{"id":"P4nda0s/reverse-skills/rev-unicorn-debug"},{"id":"yaklang/hack-skills/windows-av-evasion"},{"id":"ljagiello/ctf-skills/ctf-pwn"},{"id":"yaklang/hack-skills/code-obfuscation-deobfuscation"},{"id":"hypnguyen1209/offensive-claude/red-team-ops"}]},"slug":{"owner":"hypnguyen1209","repo":"offensive-claude","skill":"shellcode-dev"},"version":"a89fe2b4"}