ShenCode

A versatile tool for working with shellcodes.

Features

Version 0.8.0

• core
  • extract - extract from/to offset
  • msfvenom - create payloads with msfvenom
  • output - Inspect and display files in different formats
• encoder
  • aes - Encrypt payload with AES
  • bytebert - advanced polymorphic encoder
  • byteswap - New XOR Encryption, Swapping Bytes (Blog Post)
  • xor - Encode payload with custom XOR key
  • xorpoly - polymorphic x64 in-memory decoder (for details, visit this Blog Post)
• inject
  • dll - inject a dll into a process
  • injection - inject shellcode into process (Windows only)
  • ntinjection - native injection with undocumented windows functions
  • psoverwrite - process overwriting injection technique by hasherezade
• obfuscate
  • Feed - Splits Bytes in a feed.xml file as article IDs
  • QR-Code hide OpCodes as QR-Code image
  • ROR13 to ROL conversion with custom key (Windows only)
  • UUID obfuscation - Please, check out my Blog Post about this encoder
• stager
  • meterpreter - Initiate a meterpreter/reverse_tcp stage
  • sliver - Initiate a https sliver stage
• archive
  • formatout - display raw shellcodes in C++, C# and more

How to use

Install

git clone https://github.com/psycore8/shencode
cd shencode
pip install .
shencode -h

General usage

Check out the ShenCode Docs for more information.

Release Notes

• general - windows functions and constants sorted in windef and winconst
• general - added a new category: inject
• general - module categories sorted in alphabetical order
• general - updated dependencies
• inject/psoverwrite - Python adapted process overwriting technique
• inject/ntinjection - native api injection (experimental)
• inject/dll - dll injection
• obfuscate/feed - fixed typo
• obfuscate/qrcode - fixed dependency error for PIL

References

• Byte-Swapping
• In-Memory Decoder
• Function Name Hashing
• Win32API with python3 injection
• Violent python: XOR Encryption
• How to easily encrypt file in python