ProtectMyTooling
A multi-packer wrapper for daisy-chaining packers, obfuscators, and shellcode loaders to protect Red Team implants with watermarking and IOC collection.
What is ProtectMyTooling?
ProtectMyTooling is a Python-based wrapper that automates the daisy-chaining of multiple binary packers, obfuscators, and shellcode loaders to protect Red Team implants. It solves the problem of manually configuring and executing multiple protection tools, streamlining the creation of obfuscated, watermarked executables for engagements.
Red teamers, penetration testers, and malware developers who need to quickly obfuscate implants, collect IOCs for reporting, and watermark artifacts for traceability.
Developers choose ProtectMyTooling for its ability to chain multiple packers in one command, integrated watermarking and IOC collection, and seamless Cobalt Strike integration, saving significant time over manual tool usage.
Overview
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
Use Cases
Best For
- Obfuscating Red Team implants like beacon loaders and post-exploitation tools
- Automating implant protection in a CI/CD pipeline for malware development
- Collecting IOCs (hashes, metadata) for blue team reporting during engagements
- Watermarking PE artifacts with custom markers for attribution and tracking
- Backdooring legitimate PE files with shellcode for evasion
- Integrating with Cobalt Strike for protected uploads and execute-assembly commands
Not Ideal For
- Projects requiring GUI-based obfuscation with interactive configuration and visual feedback
- Environments where antivirus software cannot be disabled or excluded, as the contrib directory triggers AV alerts
- Cross-platform development on non-Windows systems without WSL, due to limited and untested Linux support
- Teams seeking guaranteed binary stability, as packer chaining can lead to crashes and requires careful format matching
Pros & Cons
Pros
Automates daisy-chaining of multiple packers like UPX(Hyperion(file)) in a single command, enabling layered protection without manual tool switching.
Integrates RedWatermarker for PE artifact watermarking (e.g., DOS stub, checksum) and auto-collects IOCs into CSV files, streamlining engagement tracking and reporting.
Provides a Cobalt Strike aggressor script for protected-upload and protected-execute-assembly commands, seamlessly embedding obfuscation into implant deployment pipelines.
Supports wrappers for over 30 packers and obfuscators, including open-source (e.g., ConfuserEx, ScareCrow) and commercial tools, offering flexibility in protection strategies.
Cons
Requires disabling AV or adding exclusions for the contrib directory, which contains flagging obfuscators, making it impractical in secured or monitored environments.
Primarily tested on Windows; Linux support is limited and untested, with packers like ScareCrow needing WSL setup, hindering cross-platform use.
Demands manual YAML configuration for each packer and dependencies like golang in WSL, adding setup overhead compared to drop-in solutions.
Frequently Asked Questions
Related Projects
ConfuserExAn open-source, free protector for .NET applications
PEzorOpen-Source Shellcode & PE Packer
AmberReflective PE packer.
CrinklerCrinkler is an executable file compressor (or rather, a compressing linker) for compressing small 32-bit Windows demoscene executables. As of 2026, it is the most widely used tool for compressing 1k/4k/8k intros.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.