shellcode-dev
Shellcode-dev guides you through building position-independent code for implant delivery, covering PEB walking for API resolution, ROR13 hashing, and null-byte elimination. It includes loader patterns, PE conversion tools, and evasion strategies for bypassing static detection across Windows, Linux, and macOS platforms.
Shellcode-dev helps you write position-independent shellcode using PEB walking, API hashing, and evasion techniques.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/shellcode-dev · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/shellcode-dev ~/.claude/skills/shellcode-devnpx skillfed install hypnguyen1209/offensive-claude/shellcode-devFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to write position independent shellcode?
Shellcode-dev teaches position-independent code construction by leveraging PEB (Process Environment Block) walking to dynamically resolve Windows APIs without hardcoded addresses. The skill covers ROR13 hashing for API name obfuscation, null-byte elimination techniques, and x86/x64 architecture patterns. This approach ensures your shellcode runs reliably across different process memory layouts and Windows versions.
What does shellcode-dev cover for loader evasion?
Shellcode-dev addresses detection evasion through multiple injection alternatives: early bird APC injection, threadless hook-based injection, pool party thread pool techniques, and mockingjay RWX section abuse. It also covers indirect syscalls, hell's gate runtime SSN resolution, and halo's gate hooked syscall recovery—all designed to bypass EDR monitoring of traditional CreateRemoteThread calls.
Can shellcode-dev convert PE files to shellcode?
Shellcode-dev includes PE-to-shellcode conversion guidance, referencing tools like Donut for transforming compiled binaries into position-independent shellcode. This enables delivery of full applications through shellcode loaders while maintaining evasion properties and cross-platform compatibility.
What polymorphic and metamorphic techniques does shellcode-dev teach?
Shellcode-dev covers polymorphic encoder patterns and metamorphic self-modifying code strategies for dynamic evasion. These techniques alter shellcode structure at runtime to defeat signature-based detection while preserving functionality across execution contexts.
Does shellcode-dev support non-Windows platforms?
Shellcode-dev extends beyond Windows to cover cross-platform shellcode development for Linux and macOS, adapting PEB-walking and API-hashing concepts to Unix-like syscall conventions and loader mechanisms.
SKILL.md
rendered from the published skill — quoted content, verbatim
Shellcode Development
When to Activate
- Writing custom x86/x64 shellcode
- Implementing position-independent code (PIC)
- Building shellcode loaders for implant delivery
- Evading AV/EDR static detection
- Converting PE files to shellcode
- Cross-platform shellcode development
Execution Pattern (Allocate-Write-Execute)
Avoid direct PAGE_EXECUTE_READWRITE — prefer two-step:
```c // 1. Allocate with RW char *dest = VirtualAlloc(NULL, size, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE); // 2. Write shellcode memcpy(dest, shellcode, size); // 3. Switch to RX (no write permission) VirtualProtect(dest,
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/shellcode-dev/SKILL.md