Loaders & Packers
How a payload gets from bytes on disk to mapped, relocated and running — and which stage of that pipeline each detection actually watches.
7 techniques
T1027Windows08-04T1027.009Windows08-04T1027.009Windows, Linux08-04T1027.009Windows, Linux08-04T1059.006Windows08-04T1620Windows09-04T1620Windows09-04
PE Packer / Crypter
Wrap a PE inside an encrypted stub that unpacks and maps the payload at runtime.
Donut Shellcode Generation
Convert any PE, .NET assembly, or VBScript into position-independent shellcode using the Donut framework for fileless in-memory execution.
Position-Independent Code (Shellcode)
Write code that runs at any memory address without relocation — the basis of every staged payload.
Encrypted Shellcode Loader
Decrypt and execute shellcode at runtime so the payload never touches disk in plaintext.
Beacon Object File (BOF) Development
Write position-independent C code that executes inside a Cobalt Strike or Havoc beacon process without spawning a new process or touching disk.
Manual PE Mapping
Map a PE into memory by hand - parse the headers, reserve sections, and patch relocations without a loader.
PE to Shellcode
Embed a PE as bytes in position-independent shellcode that reflects the image into memory and jumps to its entry point.
no techniques match those filters.