PayloadFactory
A payload factory that embeds shellcode into C++ stubs and cross-compiles them into self-contained executables (or DLLs) that inject into a target process — for Windows and Linux. It layers multiple evasion techniques: SysPlant/Syswhispers syscall generation, XOR and word-list obfuscation, OLLVM, environmental keying, and sandbox detection.
Key Features
Multi-Technique Injection
31 Windows and 7 Linux injection techniques — from classic remote-thread and process hollowing to fiber, peb walk, mockingjay, and ssdt hijack.
Syscall Obfuscation
SysPlant-driven syscall generation (embedded, jumper, randomized, egg-hunter recovery) with optional randomization of syscall names.
Payload Obfuscation
Embed shellcode as a plain byte array, a shuffled English word list, or XOR-encrypted with a 49-byte key.
Environmental Keying
Bind the decryption key to a target attribute (hostname, domain, username, MAC) so the payload decrypts to garbage elsewhere — no suspicious exit.
Sandbox Evasion
Pre-execution hooks (ETW, AMSI, ntdll unhook, sleep obfuscation) plus runtime checks (CPU, memory, DLL, hostname, username, domain, sleep).
DLL Output & Proxying
Emit a DLL instead of an EXE and proxy the exports of a legitimate DLL for side-loading.
OLLVM Cross-Compilation
Cross-compile with MinGW g++ or Clang++ (Obfuscator-LLVM: -bcf, -sub, -fla, -split, -sobf) for Windows, and g++/clang++ for Linux.
PE-to-Shellcode
Convert an arbitrary Windows PE into shellcode with the bundled donut binary, then inject it via any technique.