ShenCode

A versatile tool for working with shellcodes.

Features

ShenCode is a framework for developing, analyzing and testing shellcodes. It supports the following operating modes:

  • Argument mode
    • shencode core output -i file.raw -s inspect
  • Interactive Mode
    • shencode$ load output
    • shencode::core::output$
  • Task Mode
    • Automate modules in different steps with json

Version 0.9.0

General usage

Check out ShenCode Docs and the starter tutorial for more information.

Modules

CategoryDescriptionModules
coreShencode core functionsdownload - extract- inspect - minidump - output - subproc - task
encoderShellcode encoderalphanum - bytebert - byteswap1 - multicoder - xor - xorchain - xorpoly2
injectProcess injection modulesdll - injection - linject - ntinjection - psoverwrite3
obfuscateShellcode obfuscation techniquesfeed4 - qrcode - rolhash - uuid
payloadModules to generate payloadsmsfvenom - winexec
stagerStage loadersmeterpreter - sliver

How to use

Install
git clone https://github.com/psycore8/shencode
cd shencode
python -m venv .venv
<! ACTIVATE-VENV-SEE-BELOW !>
pip install .
shencode -h

To activate the virtual environment use the following command:

  • Windows - .venv\bin\activate
  • Linux - source .venv/bin/activate

Release Notes

  • general - code cleanup
  • general - improved output with rich implementation
  • general - ShenCode as python module
  • core/inspect - seperated the file inspect function to a module, including html export
  • core/output - removed inspect
  • core/task - Improved JSON scheme for better iteration and multiple module usage in one file
  • obfuscate/uuid - file output and reverse function added
  • stager/meterpreter - fixed some argument errors
  • stager/sliver - fixed a datatype error and os.name implementation

References

Footnotes

  1. Byteswapping Blog Post

  2. Polymorphic XOR decoder Blog Post

  3. hasherezade

  4. feed uses a diceware wordlist