← Back to Dashboard

Donut

// PE-to-Shellcode Masterclass

8
Modules
C
Language
x86/x64
Architecture
3
Difficulty Tiers

Master the industry-standard framework for generating position-independent shellcode from PE files, .NET assemblies, VBS/JS scripts, and XSL files. Learn the complete architecture from PE loading fundamentals through CLR hosting to Chaskey-encrypted PIC loaders. By TheWover & Odzhan.

01 Beginner

The PE-to-Shellcode Problem

Why you'd want to convert an EXE/DLL/.NET assembly to shellcode, use cases, and the difference between loaders and converters.

 02 Beginner

PE Loader Fundamentals

What a PE loader must do: map sections, resolve imports, apply base relocations, execute TLS callbacks, and call the entry point.

 03 Beginner

.NET CLR Hosting

Loading the CLR runtime, AppDomain creation, Assembly::Load, and how Donut executes .NET assemblies entirely in-memory.

 04 Intermediate

Donut Module Architecture

The DONUT_MODULE structure, DONUT_INSTANCE configuration, payload compression with aPLib and LZNT1/Xpress, and staging.

 05 Intermediate

The Donut Loader

PIC loader shellcode: API resolution via PEB walking, decryption, decompression, and module-type dispatch to the correct handler.

 06 Intermediate

Encryption & Anti-Detection

Chaskey block cipher, random instance keys, entropy reduction, AMSI/WLDP/ETW bypass stubs built into the loader.

 07 Advanced

Advanced Payload Types

VBS/JS/XSL execution via COM objects, unmanaged DLL loading with custom arguments, PE with parameters, and exit options.

 08 Advanced

Full Chain, Integration & Detection

Command-line usage, C API integration, detection vectors, YARA rules, memory forensics, and defensive countermeasures.

References & Resources