Ember

WinExec shellcode generator (x64/x86) from a command. Built for maldev testing. ^__^

Quick start

build

cargo build --release

raw shellcodes

# Generate a shellcode
./target/release/ember -c 'notepad.exe' -o shell.bin
# Run it (Windows) | demo runners for testing in ./demo/*
./demo/runner.exe shell.bin

generating shellcodes for loaders

Formats: raw · hex · c · csharp · vba · uuid · ps1 · rust · python / py · go

./target/release/ember -c 'calc.exe' -f rust

Without -o, the payload goes to stdout (handy for piping). Info messages only show up when writing to a file.

Transforming the shellcode

# Payload encrypted
./target/release/ember -c 'explorer.exe' -f go --encrypted
# ---- OUTPUT ------
# key := []byte{0x65, ...}
# shellcode := []byte{0x82, .... }

# Payload encoded in base64
./target/release/ember -c 'explorer.exe' -f python --base64

Architecture

x64 by default. Use --x86 for 32-bit.

Demo

demo/ includes C and Rust runners to load and execute a .bin on Windows.