shellcode-dev
Shellcode-dev guides you through building position-independent code for implant delivery, covering PEB walking for API resolution, ROR13 hashing, and null-byte elimination. It includes loader patterns, PE conversion tools, and evasion strategies for bypassing static detection across Windows, Linux, and macOS platforms.
Shellcode-dev helps you write position-independent shellcode using PEB walking, API hashing, and evasion techniques.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Shellcode-dev helps you write position-independent shellcode using PEB walking, API hashing, and evasion techniques. Shellcode-dev guides you through building position-independent code for implant delivery, covering PEB walking for API resolution, ROR13 hashing, and null-byte elimination. It includes loader patterns, PE conversion tools, and evasion strategies for bypassing static detection across Windows, Linux, and macOS platforms.
Use it when
- Shellcode-dev addresses detection evasion through multiple injection alternatives: early bird APC injection.
- Shellcode-dev includes PE-to-shellcode conversion guidance.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/shellcode-dev · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to write position independent shellcode?
Shellcode-dev teaches position-independent code construction by leveraging PEB (Process Environment Block) walking to dynamically resolve Windows APIs without hardcoded addresses. The skill covers ROR13 hashing for API name obfuscation, null-byte elimination techniques, and x86/x64 architecture patterns. This approach ensures your shellcode runs reliably across different process memory layouts and Windows versions.
What does shellcode-dev cover for loader evasion?
Shellcode-dev addresses detection evasion through multiple injection alternatives: early bird APC injection, threadless hook-based injection, pool party thread pool techniques, and mockingjay RWX section abuse. It also covers indirect syscalls, hell's gate runtime SSN resolution, and halo's gate hooked syscall recovery—all designed to bypass EDR monitoring of traditional CreateRemoteThread calls.
Can shellcode-dev convert PE files to shellcode?
Shellcode-dev includes PE-to-shellcode conversion guidance, referencing tools like Donut for transforming compiled binaries into position-independent shellcode. This enables delivery of full applications through shellcode loaders while maintaining evasion properties and cross-platform compatibility.
What polymorphic and metamorphic techniques does shellcode-dev teach?
Shellcode-dev covers polymorphic encoder patterns and metamorphic self-modifying code strategies for dynamic evasion. These techniques alter shellcode structure at runtime to defeat signature-based detection while preserving functionality across execution contexts.
Does shellcode-dev support non-Windows platforms?
Shellcode-dev extends beyond Windows to cover cross-platform shellcode development for Linux and macOS, adapting PEB-walking and API-hashing concepts to Unix-like syscall conventions and loader mechanisms.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Shellcode Development
When to Activate
- Writing custom x86/x64 shellcode
- Implementing position-independent code (PIC)
- Building shellcode loaders for implant delivery
- Evading AV/EDR static detection
- Converting PE files to shellcode
- Cross-platform shellcode development
Execution Pattern (Allocate-Write-Execute)
Avoid direct PAGE_EXECUTE_READWRITE — prefer two-step:
```c // 1. Allocate with RW char *dest = VirtualAlloc(NULL, size, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE); // 2. Write shellcode memcpy(dest, shellcode, size); // 3. Switch to RX (no write permission) VirtualProtect(dest,
(truncated - see the full file via the links below)
File tree — 1 file
skills/shellcode-dev/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Write position-independent shellcode with PEB walking and API hashing”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
EDR Evasion covers defensive bypass methods used in red team engagements, from userland hook removal and direct syscall execution to AMSI patching and memory encryption. Learn how EDRs monitor endpoints and the techniques—including PPID spoofing, process injection variants, and ETW patching—that evade their detection.
ctf-malware equips you with techniques for dissecting malware in CTF competitions, covering obfuscated scripts, binary analysis, network traffic decryption, and evasion detection. It guides you through static analysis with tools like YARA and Capstone, dynamic analysis with strace and ltrace, and memory forensics with Volatility, plus custom crypto protocol identification and malware configuration extraction.
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems. It covers AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
Stack Overflow & ROP covers advanced control-flow hijacking via return address overwrite on Linux userland binaries. Learn buffer overflow fundamentals, libc leaking strategies, ROP gadget selection, ret2csu for multi-argument calls, ret2dlresolve for blind resolution, SROP for register control, and stack pivoting under constraints. Includes tool comparisons and real-world exploitation patterns.
Learn to exploit kernel vulnerabilities like use-after-free, out-of-bounds access, and race conditions for privilege escalation. This skill covers environment setup with QEMU, building exploitation primitives, bypassing mitigations like KASLR and SMEP, and executing kernel ROP chains to achieve root access.
More skills browser-exploitation-v8 (MIT) · ctf-pwn (MIT) · reverse-engineering (MIT)