D3Ext / Hooka

Evasive shellcode loader, hooks detector and more

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Where is the final file saved?

tailerbro opened this issue · comments

Hello boss. please tell me, where is the final shellcode saved?
Untitled

commented

What do you mean?
The image shows how the shellcode is injected on the same thread, it takes the shellcode (in this case it's generated with msfvenom) from a file (in this case called shellcode.bin). This doesn't generates a new shellcode

commented

The purpose of the tool is evading basic AV analysis via injecting shellcode on memory

Understood, I meant that the shellcode.bin remains the same, the file is not changed in any way . I thought maybe a patched shellcode.bin file was created and saved somewhere else.

commented

No problem. If you want to convert a binary to shellcode you can use Donut, it has a lot of different options and formats for your shellcode