Shellcode Dev

This is comprehensive shellcode engineering for building position-independent payloads, custom loaders, and PE-to-shellcode converters. You get PEB walking patterns for Windows API resolution, ROR13 hashing, null-byte avoidance tricks, and concrete allocation strategies that favor RW-then-RX over the RWX pattern EDRs flag. The loader section is strong, covering everything from fiber execution to certificate table hiding and the DripLoader pattern using syscalls. Includes cross-platform notes for Linux, macOS, and Windows on ARM64. This is red team tooling for when msfvenom payloads won't cut it and you need custom shellcode that evades modern defenses. Updated for Windows 11 24H2 AMSI heap scanning.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill shellcode-dev --agent claude-code

Installs into .claude/skills of the current project.

Files

Shellcode Development

When to Activate

Writing custom x86/x64 shellcode
Implementing position-independent code (PIC)
Building shellcode loaders for implant delivery
Evading AV/EDR static detection
Converting PE files to shellcode
Cross-platform shellcode development

Execution Pattern (Allocate-Write-Execute)

Avoid direct PAGE_EXECUTE_READWRITE — prefer two-step:

// 1. Allocate with RW
char *dest = VirtualAlloc(NULL, size, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
// 2. Write shellcode
memcpy(dest, shellcode, size);
// 3. Switch to RX (no write permission)
VirtualProtect(dest, size, PAGE_EXECUTE_READ, &old);
// 4. Execute
((void(*)())dest)();

Position-Independent Code (PIC)

Method	Platform	Notes
Call/Pop	Windows	Push next addr, pop into register
FPU state (fstenv)	Windows	Saves instruction pointer
SEH	Windows	Exception handler stores EIP
RIP-relative	x64	`lea rax, [rip+offset]`
GOT	Linux	Global Offset Table
VDSO	Linux	Kernel-provided shared object