An open-source packer that converts executables and shellcode into stealthy, evasive payloads for Windows.
PEzor is an open-source packer that converts Windows executables and shellcode into evasive payloads for security testing. It applies various obfuscation and anti-analysis techniques to bypass endpoint detection and response (EDR) systems, making it a valuable tool for red team engagements. The tool supports multiple output formats and integrates features like sleep obfuscation, environmental keying, and raw syscall usage.
Security researchers, penetration testers, and red team operators who need to generate stealthy payloads for Windows environments during authorized security assessments.
PEzor stands out by combining multiple evasion techniques into a single, scriptable tool, offering extensive customization for payload generation. Its integration with Donut for shellcode generation and support for various output formats provides flexibility unmatched by simpler packers.
Open-Source Shellcode & PE Packer
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports generation of EXE, DLL, reflective DLL, service executables, .NET assemblies, and Beacon Object Files, enabling flexibility for various attack vectors as shown in the -format options.
Combines anti-debug checks, user-land hook removal, raw syscalls, and sleep obfuscation into a single tool, directly addressing common EDR bypass methods documented in the examples.
Offers environmental keying via XOR encryption derived from system FQDN and SGN encoding for polymorphism, adding layers of target-specific and dynamic obfuscation.
Integrates with Donut for shellcode generation from executables and supports raw shellcode input, providing broad compatibility for payload creation.
The install.sh script is designed for Kali Linux, and dependencies like Donut require manual setup for other operating systems, as hinted in the upgrade note about PATH variables.
Raw syscall usage is restricted to 64-bit executables on Windows 10 only, reducing effectiveness for older systems or 32-bit targets, as noted in the -syscalls option description.
Critical usage details are spread across multiple blog posts linked in the README, making it challenging for users to find consolidated, up-to-date guidance without external research.