mgeeky/ShellcodeFluctuation

Health v2 · maintenance only

Adoption not part of the score

1127 stars · 163 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A C++ proof-of-concept implementing an in-memory evasion technique that encrypts shellcode and fluctuates its memory protection between RW/NoAccess and RX while it sleeps. It hooks kernel32!Sleep to hide Cobalt Strike Beacon implants from memory scanners like Moneta and pe-sieve.

Use cases

• evade memory scanners detecting shellcode in RWX regions
• encrypt beacon payload while sleeping
• hide shellcode memory pages from pe-sieve and Moneta
• implement sleep-time shellcode encryption in red team tooling
• study in-memory evasion techniques
• flip shellcode memory protection between RW and RX

When to choose

• you need a reference implementation of sleep-time shellcode encryption
• you're building red team tooling that must evade memory scanners
• you want to learn how memory protection fluctuation works

When to avoid

• you need a weaponized production implant
• you target non-Windows platforms
• you need a maintained tool with ongoing support

Facets

library · maturity maintenance

security cryptography security penetration-testing windows cpp shellcode memory-evasion red-team cobalt-strike sleep-encryption poc

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mgeeky/ShellcodeFluctuation")