Shellcode Encoding

Before the stub is compiled, PayloadFactory embeds the shellcode using one of three encodings. This changes how the bytes appear in the compiled binary, so a raw strings/byte scan on the final payload does not reveal the payload.

Select the encoding with a mutually-exclusive pair of flags (default is plain, i.e. neither flag):

# Plain byte array (default)
python main.py current_thread -s sc.bin -o plain.exe

# Word-list encoding
python main.py current_thread -s sc.bin -w -o word.exe

# XOR encoding
python main.py current_thread -s sc.bin -x -o xor.exe

Plain (__set_plain_shellcode)

Shellcode is stored as a C byte array (0x.. hex values) with a matching plain_decode decoder. This is the fallback when neither -w nor -x is given.

Word-list (-w/--word-encode)

Each shellcode byte is replaced by an index into a randomized list of 256 distinct English words drawn from the bundled words_alpha.txt dictionary. The decoder maps the index back to the byte at runtime, so the payload bytes never appear literally in the binary.

XOR (-x/--xor-encode)

Shellcode is XOR-encrypted with a 49-byte key generated at build time (generate_key(DEFAULT_KEY_LEN)). The key is embedded in the stub and a xor_decode decoder reverses the encryption at runtime.

Note: the XOR key here is a random build-time key. If you need the key to be derived from the target environment (so the payload decrypts to garbage on the wrong host), use environmental keying instead — that is a separate, optional layer.

Interaction with environmental keying

Environmental keying (see the evasion guide) applies an additional XOR derived from a target attribute (hostname, domain, username, or MAC). It can be combined with any of the three base encodings above — the base encoder handles the raw bytes, and the environmental key binds them to a specific host.