shellcodeloader: ShellcodeLoader of windows can bypass AV
ShellcodeLoader
ShellcodeLoader of windows can bypass AV.
Features
- It has many loading modes. There are 13 loading modes in 32 bits and 12 loading modes in 64 bits.
- Support development. If a new attack means is found, you can develop a template according to the specified method.
- Shellcode is automatically encrypted. The md5 of loaders that come from the same shellcode is different because the generator uses time as a seed to randomly generate 128-bit keys for encryption.
Files
The tool is composed of a generator (Shellcodeloader.exe) and numerous loader templates. Different loader templates need to be placed in the corresponding arch of directories. And finally, put it into the DATA folder under the same directory of the generator.
How to use
- Open the generator(shellcode.exe)
- Drag your raw shellcode(.bin) into the generator
- Choose the loader’s arch (default x86)，And select the configuration options you want, whether you want to autostart(which comes with a registry), and whether you want to anti sandbox(This option is not required for most 64-bit loaders)
- Choose how you want to load it. Different loading methods depending on the loading template in the DATA folder.
- **Click Generate and the final loader will be generated on the desktop. **
How to expand
- include public.hpp in your cpp.
- Call the GetShellcodeFromRes() function to get shellcode,the number 100 is immutable,unless you change the resourceID in generator.
It will return the pointer of the shellcode in resource, and shellcodesize is the size of the shellcode. In most cases, this step doesn’t need to be changed, you can do anything after you get the shellcode.
- Loading shellcode in your method, and compile(PS: Make sure you compile statically and cancel the debug symbolic link)
- Use method name your template, this name will be loading method’s name on UI and change its format to “DAT”,，Put it in a correct arch in DATA folder, The generator will automatically get the loading method.
About public.hpp
public.hpp contains the necessary comments. If you want other ways of an anti sandbox, you can change the content of the anti sandbox function; if you want other ways of self-starting, you can change the content of the autostart function. In most cases, the contents of other function bodies do not need to be changed.
