EgeBalci/amber

Health v2 · maintenance only

Adoption not part of the score

1442 stars · 219 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Amber is a reflective PE packer that converts Windows PE files (EXE, DLL, SYS) into position-independent shellcode payloads for in-memory execution. It encodes payloads with the SGN encoder and resolves Windows API addresses covertly to evade antivirus, IDS/IPS, and application whitelisting.

Use cases

• pack a PE executable into reflective shellcode
• bypass antivirus detection for a payload
• load a DLL in memory without touching disk
• generate encoded shellcode from a Windows binary
• stage a payload from a remote server
• evade memory scanners after payload execution

When to choose

• you need to run native Windows PE files entirely in memory
• you want SGN-encoded, position-independent payloads for red-team operations
• you need a CLI tool with prebuilt binaries or Docker support

When to avoid

• you need a general-purpose executable packer for legitimate software distribution
• you target non-Windows platforms
• you need a maintained GUI or extensive documentation

Facets

cli-tool · maturity active

security cryptography security penetration-testing windows go cli pe-packer reflective-loader shellcode payload-encoding red-team evasion docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="EgeBalci/amber")