Reference

Snippets

Reusable ASM building blocks shipped with Shell[SNIP], per platform.

Snippets

Snippets are reusable ASM building blocks referenced via [[SNIPPET_NAME]]. Names are matched case-insensitively against the .asm file basename in templates/snippets/{os}_{arch}/.

win_64

Snippet	Purpose
`setup_hash_resolver`	PEB walk to find kernel32.dll base + `parse_module` ROR13 routine.
`setup_kernel_resolver`	PEB walk to find kernel32.dll base and set up the resolver routine.
`resolve_api_hash`	Resolve an API by ROR13 hash via `parse_module`.
`resolve_func_api_addr`	Resolve a function API address.
`resolve_func_from_dll`	Resolve a function from a loaded DLL handle via `GetProcAddress`.
`resolve_kernel_api`	Resolve a kernel32 API by hash.
`get_addrtable_from_exporttable`	Extract the address table from an export table.
`get_kernel_base_addr`	Locate the kernel base address.
`get_kernel_exporttable_addr`	Locate the kernel export-table address.
`load_dll`	`LoadLibraryA` wrapper (params: `name`, `lla`).
`wsa_startup`	`WSAStartup` call.
`wsa_socket_tcp`	`WSASocketA` (AF_INET, SOCK_STREAM).
`wsa_connect`	`WSAConnect` with a `sockaddr_in`.
`create_process_redirect`	`CreateProcessA` with I/O redirection.
`open_process`	`OpenProcess` wrapper.
`virtual_alloc_ex`	`VirtualAllocEx` (RW) wrapper.
`write_process_memory`	`WriteProcessMemory` wrapper.
`virtual_protect_ex`	`VirtualProtectEx` (RW → RX) wrapper.
`create_remote_thread`	`CreateRemoteThread` wrapper.

posix_64

Snippet	Purpose
`socket_tcp`	`socket` syscall (AF_INET, SOCK_STREAM).
`connect_tcp`	`connect` syscall with a `sockaddr_in`.
`dup2_stdio`	`dup2` loop over stdin/stdout/stderr.
`execve_sh`	`execve("/bin/sh", ...)` with a command string (param `cmd_reg`).
`execve_bin_sh`	`execve("/bin/sh", NULL, NULL)`.
`exit_clean`	`exit(0)` syscall.
`ptrace_attach`	`ptrace(PTRACE_ATTACH, pid)`.
`ptrace_getregs`	`ptrace(PTRACE_GETREGS)` → `user_regs_struct`.
`ptrace_poketext`	`ptrace(PTRACE_POKETEXT)` write loop.
`ptrace_setregs`	`ptrace(PTRACE_SETREGS)` to redirect RIP.
`ptrace_detach`	`ptrace(PTRACE_DETACH)` to resume the target.
`wait_process`	`wait4(pid, WUNTRACED)`.
`setup_elf_resolver`	ELF resolver: `find_lib` + `elf_lookup` routines.
`find_lib_base`	Find a shared library base via `/proc/self/maps`.
`resolve_elf_hash`	Resolve an ELF symbol by djb2 hash.

The full list can also be discovered at runtime with the MCP list_snippets tool or by reading the templates/snippets/{os}_{arch}/ directory directly.

Edit this pageorReport an issue

Encoders API

The encoder framework — AbstractEncoder, EncoderRegistry, xor, and chunk.

Padding API

The padding framework — AbstractPaddingStrategy, PaddingRegistry, none, nop, and inert.