A multi-packer wrapper for daisy-chaining packers, obfuscators, and shellcode loaders to protect Red Team implants with watermarking and IOC collection.
ProtectMyTooling is a Python-based wrapper that automates the daisy-chaining of multiple binary packers, obfuscators, and shellcode loaders to protect Red Team implants. It solves the problem of manually configuring and executing multiple protection tools, streamlining the creation of obfuscated, watermarked executables for engagements.
Red teamers, penetration testers, and malware developers who need to quickly obfuscate implants, collect IOCs for reporting, and watermark artifacts for traceability.
Developers choose ProtectMyTooling for its ability to chain multiple packers in one command, integrated watermarking and IOC collection, and seamless Cobalt Strike integration, saving significant time over manual tool usage.
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Automates daisy-chaining of multiple packers like UPX(Hyperion(file)) in a single command, enabling layered protection without manual tool switching.
Integrates RedWatermarker for PE artifact watermarking (e.g., DOS stub, checksum) and auto-collects IOCs into CSV files, streamlining engagement tracking and reporting.
Provides a Cobalt Strike aggressor script for protected-upload and protected-execute-assembly commands, seamlessly embedding obfuscation into implant deployment pipelines.
Supports wrappers for over 30 packers and obfuscators, including open-source (e.g., ConfuserEx, ScareCrow) and commercial tools, offering flexibility in protection strategies.
Requires disabling AV or adding exclusions for the contrib directory, which contains flagging obfuscators, making it impractical in secured or monitored environments.
Primarily tested on Windows; Linux support is limited and untested, with packers like ScareCrow needing WSL setup, hindering cross-platform use.
Demands manual YAML configuration for each packer and dependencies like golang in WSL, adding setup overhead compared to drop-in solutions.