A reflective PE packer for in-memory execution of Windows executables to bypass security products.
Amber is a reflective PE packer that loads and executes Windows Portable Executable files (EXE, DLL, SYS) directly in memory. It solves the problem of deploying payloads stealthily by avoiding disk writes and bypassing security products like anti-virus and intrusion detection systems.
Security researchers, penetration testers, and red team operators who need to deploy evasive payloads during assessments or simulations.
Developers choose Amber for its focus on evasion, offering features like in-memory execution, payload encoding, and memory cleanup that make it effective against modern security defenses.
Reflective PE packer.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Loads and executes PE files entirely in memory without touching disk, effectively bypassing file-based anti-virus and EDR solutions as highlighted in the README.
Automatically encodes payloads with the SGN encoder, adding multiple layers of obfuscation to evade signature-based detection, with configurable encoding iterations via the -e flag.
Uses CRC32_API or IAT_API to resolve Windows API addresses inconspicuously, reducing forensic footprints by avoiding direct API name exposure.
Erases the reflective payload from memory after execution, as stated in the README, helping to evade memory scanners and forensic analysis tools.
Requires installing the keystone engine from source for building, which adds non-trivial setup steps compared to simple Go toolchains, as noted in the installation instructions.
Specifically designed for Windows PE files (EXE, DLL, SYS), making it useless for other platforms or executable formats like .NET assemblies or Linux ELF files.
Tailored for offensive security and evasion, lacking features for legitimate software development, such as error handling or integration with standard deployment pipelines.