kyleavery/AceLdr

Health v2 · maintenance only

Adoption not part of the score

1031 stars · 184 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

AceLdr is a position-independent reflective loader (UDRL) for Cobalt Strike written in C, designed to evade memory scanners like Moneta, PE-sieve, and BeaconEye. It employs dynamic heap encryption, code obfuscation, return address spoofing, and sleep-based memory encryption to hide beacon artifacts.

Use cases

• evade memory scanners when running Cobalt Strike beacons
• load beacon shellcode with a user-defined reflective loader
• encrypt beacon memory during sleep to bypass scanning tools
• bypass BeaconEye, Moneta, PE-sieve, and Hunt-Sleeping-Beacons detections
• spoof return addresses to defeat stack-based detection
• implement sleep obfuscation for red team operations

When to choose

• you need a Cobalt Strike UDRL that defeats modern memory scanners
• your red team engagement requires evading tools like Moneta or PE-sieve
• you want heap encryption and return address spoofing out of the box

When to avoid

• you use loaders that require the shellcode thread to stay alive
• you need a loader for frameworks other than Cobalt Strike
• you are not authorized to use offensive security tooling

Facets

library · maturity active

security cryptography reverse-engineering security penetration-testing windows cpp cobalt-strike udrl memory-scanner-evasion red-team offensive-security beacon sleep-obfuscation position-independent-code

Member repositories

For agents

markdown · JSON · MCP: product_card(name="kyleavery/AceLdr")