{"repo":"D7EAD/mkPIVM","free":true,"listed":false,"github":"https://github.com/D7EAD/mkPIVM","clone":"git clone https://github.com/D7EAD/mkPIVM.git","description":"Generate polymorphic, position-independent virtual machines (PIVMs) from arbitrary x86/x64 shellcode.","language":"C++","stars":414,"topics":["exploit","exploitation","malware","research","reverse-engineering","shellcode","virtual-machine","virtualization","cobalt-strike","havoc"],"license":"MIT","category":"security-tools","readme_excerpt":"Read the research paper (written for 1.0.0). mkPIVM payloads have remained fully undetected since the release of this project. mkPIVM is a polymorphic position-independent shellcode virtualizer for Windows x86 and x64 (Linux soon). Feed it raw shellcode. It emits another raw blob: a small virtual machine that interprets a lifted, encrypted-at-rest version of your original instructions. The output is itself position-independent code and runs anywhere the original shellcode would, from a remote-thread loader to a code cave detour. Every per-seed knob varies independently: cipher family, register slot layout, opcode-to-handler permutation, dispatcher topology, junk-gadget pattern, IR obfuscation insertion points. Two builds from the same input share fewer than a hundred coincidental bytes out of tens of kilobytes. Why: native shellcode is signature-trivial. Wrapping it in a per-instance VM with a per-instance cipher leaves nothing useful at rest, and lifting the instructions to bytecode puts another wall between disk bytes and any disassembler that knows what x86 looks like. As far as I can tell from a literature sweep, no public tool ships exactly this pipeline: raw PIC in, raw polymorphic VM PIC out. So, I mentioned that in the research paper it demanded. To be honest, if I am right about no one having done this (publicly) before, and I am pretty confident, I am surprised. Nonetheless, enjoy. Related Work & Plans Linux support will be added soon. Quick start Your PIVM is hot a","default_branch":null,"files":null,"tree":[],"storefront":"/r/D7EAD","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/D7EAD/mkPIVM/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}