Introduction

PayloadFactory is a payload factory that produces self-contained, cross-compiled executables (or DLLs) which inject shellcode into a target process. It embeds your shellcode into a C++ stub template, layers a set of AV/EDR evasion techniques on top, and cross-compiles the result for a Windows or Linux target.

It is a red-team / offensive-security tool: the output is a shellcode injector. Use it only on systems you own or are explicitly authorized to test.

How it works

The pipeline is:

1. Load shellcode — from a raw .bin/.hex/.raw file, an object file (via objdump), a hex string, or by converting a Windows PE with the bundled donut binary.
2. Embed the shellcode in a C++ stub — as a plain byte array, a shuffled English word list, or XOR-encrypted.
3. Select an injection technique — one of many Windows or Linux methods that places and executes the shellcode in a target process.
4. Apply evasion — SysPlant/Syswhispers syscall generation, pre-execution hooks (ETW, AMSI, ntdll unhook), sandbox checks, and optional environmental keying.
5. Cross-compile — with MinGW g++/clang++ (OLLVM) for Windows, or g++/clang++ for Linux.

Supported platforms

Architecture selection: -x86 (32-bit) or -x64 (64-bit, default).

How you can use it

• CLI (main.py) — the primary interface; load shellcode, pick an injection technique, and set evasion flags.
• Python API — import PayloadFactory and ExecutableFactory to drive the same pipeline from your own tooling.

Continue to Installation to set up the required toolchain.