Hollow

Hollow hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. Getting Started Binaries are available on the releases page, or build from source: Requires x8664-w64-mingw32-gcc for cross-compilation. On Arch Linux: pacman -S mingw-w64-gcc On Debian/Ubuntu: apt install gcc-mingw-w64-x86-64 Usage Flag Description ------ ------------- -shellcode Path to raw shellcode (.bin) -profile Path to a profile JSON file -templates Templates directory (default: ./templates) How does it work? hollow follows a three-step pipeline: encrypt, substitute, compile. Your shellcode is encrypted with AES-256-CBC using a randomly generated key and IV on every run. Both are embedded inside the output binary. The chosen C template then has its placeholders replaced with the encrypted shellcode, the key, and the IV, and the result is compiled into a stripped, statically linked PE by MinGW. At runtime, the loader decrypts the shellcode using Windows BCrypt and executes it using whichever injection technique the template implements. Templates