[{"data":1,"prerenderedAt":170},["ShallowReactive",2],{"navigation_docs":3,"landing":77},[4,14,31,64],{"title":5,"path":6,"stem":7,"children":8,"page":13},"Community","\u002Fdocs\u002Fcommunity","docs\u002Fcommunity",[9],{"title":10,"path":11,"stem":12},"Contributing","\u002Fdocs\u002Fcommunity\u002Fcontributing","docs\u002Fcommunity\u002F1.contributing",false,{"title":15,"path":16,"stem":17,"children":18,"page":13},"Getting Started","\u002Fdocs\u002Fgetting-started","docs\u002Fgetting-started",[19,23,27],{"title":20,"path":21,"stem":22},"Introduction","\u002Fdocs\u002Fgetting-started\u002Fintroduction","docs\u002Fgetting-started\u002F1.introduction",{"title":24,"path":25,"stem":26},"Installation","\u002Fdocs\u002Fgetting-started\u002Finstallation","docs\u002Fgetting-started\u002F2.installation",{"title":28,"path":29,"stem":30},"Quick Start","\u002Fdocs\u002Fgetting-started\u002Fquick-start","docs\u002Fgetting-started\u002F3.quick-start",{"title":32,"path":33,"stem":34,"children":35,"page":13},"Guides","\u002Fdocs\u002Fguides","docs\u002Fguides",[36,40,44,48,52,56,60],{"title":37,"path":38,"stem":39},"Injection Techniques","\u002Fdocs\u002Fguides\u002Finjection-techniques","docs\u002Fguides\u002F1.injection-techniques",{"title":41,"path":42,"stem":43},"Syscall Generation","\u002Fdocs\u002Fguides\u002Fsyscall-generation","docs\u002Fguides\u002F2.syscall-generation",{"title":45,"path":46,"stem":47},"Shellcode Encoding","\u002Fdocs\u002Fguides\u002Fshellcode-encoding","docs\u002Fguides\u002F3.shellcode-encoding",{"title":49,"path":50,"stem":51},"Evasion","\u002Fdocs\u002Fguides\u002Fevasion","docs\u002Fguides\u002F4.evasion",{"title":53,"path":54,"stem":55},"DLL Output","\u002Fdocs\u002Fguides\u002Fdll-output","docs\u002Fguides\u002F5.dll-output",{"title":57,"path":58,"stem":59},"PE to Shellcode","\u002Fdocs\u002Fguides\u002Fpe-to-shellcode","docs\u002Fguides\u002F6.pe-to-shellcode",{"title":61,"path":62,"stem":63},"Linux Targets","\u002Fdocs\u002Fguides\u002Flinux-targets","docs\u002Fguides\u002F7.linux-targets",{"title":65,"path":66,"stem":67,"children":68,"page":13},"Reference","\u002Fdocs\u002Freference","docs\u002Freference",[69,73],{"title":70,"path":71,"stem":72},"Python API","\u002Fdocs\u002Freference\u002Fpython-api","docs\u002Freference\u002F1.python-api",{"title":74,"path":75,"stem":76},"CLI Reference","\u002Fdocs\u002Freference\u002Fcli-reference","docs\u002Freference\u002F2.cli-reference",{"id":78,"title":79,"body":80,"description":79,"extension":161,"meta":162,"navigation":163,"path":164,"seo":165,"stem":168,"__hash__":169},"landing\u002Findex.md","",{"type":81,"value":82,"toc":158},"minimark",[83,109],[84,85,86,90,93],"u-page-hero",{},[87,88,89],"template",{"v-slot:title":79},"PayloadFactory",[87,91,92],{"v-slot:description":79},"A payload factory that embeds shellcode into C++ stubs and cross-compiles them into self-contained executables (or DLLs) that inject into a target process — for Windows and Linux. It layers multiple evasion techniques: SysPlant\u002FSyswhispers syscall generation, XOR and word-list obfuscation, OLLVM, environmental keying, and sandbox detection.",[87,94,95,102],{"v-slot:links":79},[96,97,101],"u-button",{"color":98,"size":99,"to":21,"trailing-icon":100},"neutral","xl","i-lucide-arrow-right","Get Started",[96,103,108],{"color":98,"size":99,"to":104,"icon":105,"target":106,"variant":107},"https:\u002F\u002Fgithub.com\u002Fx42en\u002Fpayloadfactory","i-simple-icons-github","_blank","outline","GitHub",[110,111,112,115],"u-page-section",{},[87,113,114],{"v-slot:title":79},"Key Features",[87,116,117,123,128,133,138,143,148,153],{"v-slot:features":79},[118,119],"u-page-feature",{"description":120,"icon":121,"title":122},"31 Windows and 7 Linux injection techniques — from classic remote-thread and process hollowing to fiber, peb walk, mockingjay, and ssdt hijack.","i-lucide-syringe","Multi-Technique Injection",[118,124],{"description":125,"icon":126,"title":127},"SysPlant-driven syscall generation (embedded, jumper, randomized, egg-hunter recovery) with optional randomization of syscall names.","i-lucide-shield-half","Syscall Obfuscation",[118,129],{"description":130,"icon":131,"title":132},"Embed shellcode as a plain byte array, a shuffled English word list, or XOR-encrypted with a 49-byte key.","i-lucide-type","Payload Obfuscation",[118,134],{"description":135,"icon":136,"title":137},"Bind the decryption key to a target attribute (hostname, domain, username, MAC) so the payload decrypts to garbage elsewhere — no suspicious exit.","i-lucide-key-round","Environmental Keying",[118,139],{"description":140,"icon":141,"title":142},"Pre-execution hooks (ETW, AMSI, ntdll unhook, sleep obfuscation) plus runtime checks (CPU, memory, DLL, hostname, username, domain, sleep).","i-lucide-eye-off","Sandbox Evasion",[118,144],{"description":145,"icon":146,"title":147},"Emit a DLL instead of an EXE and proxy the exports of a legitimate DLL for side-loading.","i-lucide-layers","DLL Output & Proxying",[118,149],{"description":150,"icon":151,"title":152},"Cross-compile with MinGW g++ or Clang++ (Obfuscator-LLVM: -bcf, -sub, -fla, -split, -sobf) for Windows, and g++\u002Fclang++ for Linux.","i-lucide-cpu","OLLVM Cross-Compilation",[118,154],{"description":155,"icon":156,"title":157},"Convert an arbitrary Windows PE into shellcode with the bundled donut binary, then inject it via any technique.","i-lucide-box","PE-to-Shellcode",{"title":79,"searchDepth":159,"depth":159,"links":160},2,[],"md",{},true,"\u002F",{"title":166,"description":167},"PayloadFactory — AV\u002FEDR Evasion Payload Factory","Cross-compile C++ stubs that inject shellcode into Windows and Linux processes, with SysPlant syscall generation, obfuscation, environmental keying, and sandbox evasion.","index","Zxmp96qG9D-Aliij1V_uodP6u1elZ-Z_dMdpQeN1mDI",1788423433281]