icyguider/Shhhloader

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1276 stars · 197 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Shhhloader is a Python-based builder that compiles C++ shellcode loader stubs designed to bypass AV/EDR on Windows. It supports multiple shellcode injection techniques (PoolParty, QueueUserAPC, Module Stomping, etc.), direct syscalls, NTDLL unhooking, sandbox evasion, and obfuscation options.

Use cases

• generate a Windows shellcode loader that evades Defender
• compile a C++ stub with direct syscalls for red team operations
• inject shellcode via PoolParty or QueueUserAPC
• bypass EDR hooks by unhooking NTDLL
• create a proxy DLL loader for shellcode execution
• test AV detection against obfuscated shellcode loaders

When to choose

• you need a customizable shellcode loader with many injection and evasion options for authorized penetration testing
• you want syscall-based execution with randomization and obfuscation to evade detection
• you need EXE or DLL output compiled on Linux via Mingw-w64

When to avoid

• you need a production-stable tool - it is explicitly a work in progress
• you are not doing authorized offensive security work
• you need a cross-platform loader - it targets Windows only

Facets

cli-tool · maturity active

security penetration-testing cli security penetration-testing developer-tools windows python cli shellcode-loader red-team av-evasion edr-bypass syscalls offensive-security cpp-stub-generator mingw-w64 linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="icyguider/Shhhloader")