Evasion

Windows-only. The evasion layer is implemented with Windows-specific primitives (ETW, AMSI, ntdll unhook, and Windows environment attributes). All evasion templates live under templates/windows/evasion/; there is no Linux equivalent. Do not combine these flags with --os linux.

PayloadFactory exposes three layers of EDR/AV evasion, all optional and additive:

1. Pre-execution hooks — code run before the shellcode executes (--evasion).
2. Sandbox checks — early-exit conditions evaluated at runtime (--sandbox).
3. Environmental keying — bind the payload to a specific host attribute.

Pre-execution hooks (--evasion)

These inject a function definition and a call into the stub before the shellcode runs:

python main.py thread_hijack -s sc.bin --evasion etw amsi unhook

Multiple hooks can be combined in a single --evasion list.

Sandbox checks (--sandbox)

Each check, when true, causes the payload to exit early (return TRUE) before running the shellcode — useful for refusing to run in a sandbox/VM.

python main.py process_hollow -s sc.bin -p explorer.exe \
    --sandbox cpu hostname --sandbox-hostname WORKSTATION-01

The hostname, username, and domain checks require their value flag; PayloadFactory exits with an error if you pass the check without the value.

Environmental keying (--key-source / --key-value)

Environmental keying XORs the decoded shellcode with a hash derived from a target-environment attribute. If the runtime value does not match, the shellcode decrypts to garbage — there is no explicit "wrong host, exit" branch for an EDR to flag.

python main.py thread_hijack -s sc.bin \
    --key-source hostname --key-value TARGET-PC

--key-value is required whenever --key-source is used. The expected value is hashed with the same DJB hash the C side uses, so the runtime must match exactly.