Convert Exe To Shellcode -
This entire article focuses on EXE → shellcode. If you need a DLL, Donut supports that too (-f my.dll). The process is similar but the stub calls DllMain instead of WinMain.
Understanding this technique is crucial for defenders. If you see:
...you are likely looking at reflective PE injection.
Mitigations:
msfvenom -p windows/x64/exec CMD=calc.exe -f exe -o payload.exe
Your stub must:
Shellcode is a type of machine code that is injected into a computer's memory to execute a specific task. It's often used in exploit development, malware analysis, and reverse engineering. In this guide, we'll walk you through the process of converting an EXE file to shellcode.
Converting an EXE to shellcode isn't a file format conversion; it's about taking the place of the Windows Loader. convert exe to shellcode
You are embedding the logic required to parse the PE format, resolve dependencies, fix memory addresses, and execute the program—all within a self-contained blob of bytes. Understanding this process is fundamental for anyone looking to understand how modern malware operates "in-memory" and how security tools attempt to detect it.
Converting a standard .exe file into shellcode is not as simple as renaming the file or copying its bytes. A typical executable relies on the Operating System (OS) loader to handle complex tasks like memory allocation, resolving imports (DLLs), and base relocations. For an .exe to run as "shellcode," it must be converted into Position-Independent Code (PIC) that can execute from any memory address without these external OS dependencies. Common Tools for Conversion
Several specialized tools can automate the wrapping of an .exe into a shellcode-ready format:
Donut: This is the industry-standard tool for converting VBScript, JScript, EXE, DLL, and .NET assemblies into position-independent shellcode for x86 and x64 systems.
Pe2shc: A popular tool that makes a PE (Portable Executable) file act as a shellcode. It prepends a small stub that handles the necessary loading and relocation tasks at runtime.
exec2shell: A utility used to extract the .text (executable code) section of a PE or ELF file and output it as a raw binary or C-style array.
msfvenom: Part of the Metasploit framework, it can generate various payloads and encode existing executables into shellcode formats. Manual Method: Extracting the .text Section This entire article focuses on EXE → shellcode
If you only need the raw machine instructions from the executable code section, you can use a Python script with the pefile library to extract the .text segment.
import pefile import sys # Load the EXE file pe = pefile.PE(sys.argv[1]) # Function to grab executable code from the .text section def grab_executable_code(): ops = "" for section in pe.sections: # Looking for the primary executable section if b'.text' in section.Name: for item in bytearray(section.get_data()): # Format bytes as \x00 for shellcode strings ops += f"\\xitem:02x" return ops print(grab_executable_code()) Use code with caution. Copied to clipboard Key Technical Challenges
Embedding Shellcode in .text and .data section. | by Irfan Farooq
To convert a standard Portable Executable (EXE) into shellcode, you must transform it into Position Independent Code (PIC)
that can execute directly from memory without the standard Windows OS loader. Stack Overflow Key Tools & Methods
The most reliable way to achieve this is using specialized "packers" or "loaders" that append a bootstrap to your EXE:
: The industry standard for converting VBScript, JScript, EXE, DLL, and .NET assemblies into position-independent shellcode. It works by creating a loader that handles relocation and API resolution in memory. pe_to_shellcode Understanding this technique is crucial for defenders
: A tool by hasherezade that converts a PE file into a functional shellcode while keeping the output a valid PE. sRDI (Reflective DLL Injection)
: While primarily for DLLs, sRDI is often used in conjunction with EXE-to-shellcode workflows to load code reflectively without touching the disk. Why You Can't Just "Copy Bytes"
A standard EXE file starts with headers (MZ/PE) and metadata rather than executable instructions. If you inject raw EXE bytes into memory and try to run them, the process will crash because: Stack Overflow Hardcoded Addresses
: EXEs expect to be loaded at specific memory addresses (ImageBase). Dependencies
: EXEs rely on the OS loader to find and link external libraries (DLLs). Section Alignment
: The code is organized into sections (.text, .data) that must be mapped correctly to be executable. Stack Overflow Step-by-Step Conversion (Using Donut) binary or compile it from source. Run the command donut.exe -i your_program.exe -o loader.bin loader.bin file is your raw shellcode. Verification : You can test this shellcode using a simple C-based shellcode runner that allocates memory via VirtualAlloc and creates a thread to run the buffer. Bishop Fox to test your converted payload? Rust for Malware Development | Bishop Fox
Convert EXE to reflective DLL first, then to shellcode:
# Using PowerShell script
.\ConvertTo-Shellcode.ps1 -Binary payload.exe -Output payload.bin
Understanding manual conversion deepens your knowledge of PE structure and position-independent code. This method involves writing a custom "shellcode wrapper" that acts as a mini-loader.
