11# Shellcode Injector
22
3- A proof-of-concept ** shellcode injector** that uses * clean syscalls* to bypass user-mode hooks in ** ntdll.dll ** .
3+ A proof-of-concept ** shellcode injector** that uses * clean syscalls* to bypass user-mode hooks in ntdll
44
55## Goals
66
77- ** Activity obfuscation**
8- - Inject shellcode into a target process via ** raw syscalls**
9- - ** Bypass** common user-mode hooks on Win32 APIs ( LoadLibrary, VirtualAlloc, WriteProcessMemory)
10- - ** Auto-generate** & embed a shellcode payload that ** downloads and executes a PE file**
8+ - Inject shellcode into a target process via raw syscalls
9+ - ** Bypass** common user-mode hooks on Win32 APIs LoadLibrary, VirtualAlloc, WriteProcessMemory
10+ - ** Auto-generate** & embed a shellcode payload that downloads and executes a PE file
1111
1212---
1313
@@ -25,11 +25,11 @@ A proof-of-concept **shellcode injector** that uses *clean syscalls* to bypass u
2525| ------| ---------|
2626| ` include/PEB.h ` | Struct definitions for ** PEB / TEB / LDR_MODULE** |
2727| ` include/Callbacks.h ` | Prototypes & argument structs for the three syscalls |
28- | ` Callbacks.asm ` | NASM routines: locate raw syscall stubs → unpack args → ` syscall; ret ` |
28+ | ` Callbacks.asm ` | NASM routines: locate raw syscall stubs → unpack args → syscall; ret |
2929| ` Shellcode.h.template ` | DSL (Intel syntax) between SHELLCODE_START / END markers |
3030| ` generate_shellcode_header.py ` | Assembles the DSL → overwrites ** Shellcode.h** with a byte array |
31- | ` main.cpp ` | C++ wrapper: ` EnableDebugPrivilege ` , SSN lookup, Thread Pool callbacks, wrappers for<br >NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx |
32- | ` Makefile ` | Automation: <br >1 Generate ` Shellcode.h ` <br >2 Assemble ASM routines<br >3 Compile & link → ** injector.exe** |
31+ | ` main.cpp ` | C++ wrapper: EnableDebugPrivilege, SSN lookup, Thread Pool callbacks, wrappers for<br >NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx |
32+ | ` Makefile ` | Automation: <br >1 Generate Shellcode.h <br >2 Assemble ASM routines<br >3 Compile & link → ** injector.exe** |
3333
3434---
3535
@@ -46,7 +46,6 @@ A proof-of-concept **shellcode injector** that uses *clean syscalls* to bypass u
4646
4747# # Build & Run
4848
49- ```
50491) Install NASM, MSVC, Python + Keystone beforehand
5150
52512) Generate Shellcode.h from the template
5756
58574) Launch the injector
5958injector.exe
60- ```
6159
6260---
6361
0 commit comments