NullSec ByteForge

Binary Payload Builder

A shellcode generation and encoding tool written in Kotlin, demonstrating modern language features for security-focused payload development.

🎯 Overview

NullSec ByteForge builds binary payloads with encoding, bad character avoidance, and NOP sled generation. It supports multiple architectures and output formats for security research and exploit development education.

✨ Features

• Multi-Architecture - x86, x64, ARM, ARM64, MIPS support
• Multiple Encodings - XOR, Base64, AES, custom encoders
• Bad Character Avoidance - Detect and warn about null bytes
• NOP Sled Generation - Configurable architecture-specific NOPs
• Entropy Analysis - Measure payload randomness
• Iterative Encoding - Multi-layer encoding support

🔍 Supported Configurations

Architecture	Format	Encoding	NOP
x86	RAW	None	0x90
x64	ELF	XOR	0x90
ARM	PE	Base64	0x00
ARM64	MACHO	AES	0x00
MIPS	SHELLCODE	Custom	0x00

📦 Installation

# Clone the repository
git clone https://github.com/bad-antics/nullsec-byteforge
cd nullsec-byteforge

# Compile with Kotlin compiler
kotlinc ByteForge.kt -include-runtime -d byteforge.jar

# Run
java -jar byteforge.jar

# Or use Kotlin script mode
kotlin ByteForge.kt

🚀 Usage

# Build payload from template
java -jar byteforge.jar exec_calc

# Specify architecture and encoding
java -jar byteforge.jar -a x64 -e xor template

# Add NOP sled
java -jar byteforge.jar -n 32 payload.bin

# Avoid bad characters
java -jar byteforge.jar -b "00,0a,0d" shell

# Multiple encoding iterations
java -jar byteforge.jar -e xor -i 3 payload

# List templates
java -jar byteforge.jar -l

# Run demo
java -jar byteforge.jar

💻 Example Output

╔══════════════════════════════════════════════════════════════════╗
║            NullSec ByteForge - Binary Payload Builder            ║
╚══════════════════════════════════════════════════════════════════╝

[Demo Mode]

Building sample payloads...

  [1] exec_calc

  Payload Built:
    Architecture: X86
    Format:       SHELLCODE
    Encoding:     None
    NOP Sled:     16 bytes
    Iterations:   1

  Result:
    Raw Size:     29 bytes
    Final Size:   45 bytes
    Entropy:      3.7842 bits/byte

  Preview (first 32 bytes):
    Hex:    9090909090909090909090909090909031c05068636
    Bytes:  \x90\x90\x90\x90\x90\x90\x90\x90...

  [2] reverse_shell

  Payload Built:
    Architecture: X64
    Format:       SHELLCODE
    Encoding:     XOR
    NOP Sled:     0 bytes
    Iterations:   1

  Result:
    Raw Size:     29 bytes
    Final Size:   29 bytes
    Entropy:      4.2156 bits/byte

  Warnings:
    ⚠ Bad characters found: [0x00]

═══════════════════════════════════════════

  Summary:
    Payloads Built: 3
    Total Size:     118 bytes
    Avg Entropy:    3.9542 bits/byte
    With Warnings: 1

🏗️ Architecture

┌─────────────────────────────────────────────────────────────┐
│                  Template/Input Selection                    │
│            Built-in Templates | Custom Input                │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                    PayloadBuilder                            │
│         setBytes() → addNopSled() → checkBadChars()         │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                      Encoder                                 │
│              XOR | Base64 | AES | Custom                    │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                   BuiltPayload                               │
│       Raw + Encoded Bytes | Size | Entropy | Warnings       │
└─────────────────────────────────────────────────────────────┘

🎯 Kotlin Features Demonstrated

• Data Classes - ShellcodeTemplate, PayloadConfig, BuiltPayload
• Sealed Classes - Encoding hierarchy with subtypes
• Extension Functions - toHex(), xorEncode(), calculateEntropy()
• Null Safety - Safe handling with ? and ?:
• When Expressions - Exhaustive pattern matching
• Object Declarations - Color singleton
• Collection Operations - map, filter, sumOf, groupingBy
• Builder Pattern - Fluent PayloadBuilder API

🔧 Data Classes

data class PayloadConfig(
    val arch: Architecture,
    val format: PayloadFormat,
    val encoding: Encoding,
    val badChars: Set<Byte> = emptySet(),
    val nopSled: Int = 0,
    val iterations: Int = 1
)

data class BuiltPayload(
    val config: PayloadConfig,
    val rawBytes: ByteArray,
    val encodedBytes: ByteArray,
    val size: Int,
    val entropy: Double,
    val warnings: List<String>
)

📦 Built-in Templates

Name	Arch	Description
exec_calc	x86	Execute calc.exe (demo)
reverse_shell	x64	Reverse TCP shell (demo)
bind_shell	x64	Bind shell port 4444 (demo)

🛡️ Security Use Cases

• Exploit Development - Build and test payloads
• CTF Challenges - Quick payload generation
• Security Training - Understand shellcode concepts
• AV Research - Encoding technique analysis
• Red Team Tools - Payload customization

⚠️ Legal Disclaimer

This tool is intended for:

• ✅ Authorized penetration testing
• ✅ Security research and education
• ✅ CTF competitions
• ✅ Controlled lab environments

Never use payloads against systems without explicit authorization.

🔗 Links

• Portal: bad-antics.github.io
• Twitter: x.com/AnonAntics
• GitHub: github.com/bad-antics

📄 License

MIT License - See LICENSE file for details.

🏷️ Version History

• v1.0.0 - Initial release with payload building and encoding

---

Part of the NullSec Security Toolkit