search

TheWover / donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
BSD 3-Clause "New" or "Revised" License
3.53k stars 628 forks source link

Suggestion on encoding the loader #138

Closed CaledoniaProject closed 4 months ago

CaledoniaProject commented 1 year ago

I'm wondering how loader_exe_x64.h is generated and how can I encode/modify it. The loader is already flagged by multiple AV.

TheWover commented 4 months ago

Check out the Makefiles to see how it is built. Basically, it is compiled when you run make and exe2h is used on loader.exe to generate the header files. If you want to encode/modify it then you would either need to modify the source code of the loader, integrate obfuscation into the compilation process, or encode it after it it is already generated.