🦠 C ShellcodeFluctuation Port 🦠

A Windows ​​​​🪟 shellcode injection 💉​ and memory evasion tool implementing advanced anti-analysis techniques through API hooking and dynamic memory protection manipulation.

​🔬​ Overview

ShellcodeFluctuation demonstrates proof-of-concept techniques for executing shellcode while evading memory-based detection systems. The tool intercepts Sleep() API calls to trigger memory protection changes and XOR encryption, making the shellcode invisible to memory scanners during dormant periods. 3

🗝️​ Key Features

• API Hooking: Intercepts Sleep() calls using inline trampolines (fastTrampoline)
• Memory Fluctuation: Alternates memory protection between PAGE_EXECUTE_READ, PAGE_READWRITE, and PAGE_NOACCESS
• XOR Encryption: Encrypts shellcode in memory when not executing
• Exception-Based Execution: Uses Vectored Exception Handlers (VEH) for on-demand decryption
• Cross-Platform Build: Compiles from Linux to Windows executables using MinGW 4

🔧​ Operational Modes

The tool supports four execution modes:

Mode	Description	Evasion Technique
-1	No injection, infinite loop	Testing/placeholder
0	Basic injection	No evasion
1	RW Fluctuation	XOR encryption + PAGE_READWRITE ↔ PAGE_EXECUTE_READ
2	NA Fluctuation (ORCA666)	XOR encryption + PAGE_NOACCESS ↔ PAGE_EXECUTE_READ + VEH

🔨​ Build Instructions

📋​ Prerequisites

• Linux environment (Debian/Ubuntu recommended)
• MinGW-w64 cross-compiler
• Python 3.x

🗜️​ Compilation

# Install MinGW toolchain  [header-1](#header-1)
sudo apt install mingw-w64  
  
# Compile  [header-2](#header-2)
x86_64-w64-mingw32-gcc main.c -lkernel32 -lntdll -s -O2 -o ShellcodeFluctuation.exe

🪛​ Usage

ShellcodeFluctuation.exe <shellcode.raw> <mode>

💣​ Examples

# Basic injection without evasion  [header-3](#header-3)
./ShellcodeFluctuation.exe payload.bin 0  
  
# RW fluctuation with XOR encryption  [header-4](#header-4)
./ShellcodeFluctuation.exe payload.bin 1  
  
# NOACCESS fluctuation with exception handling  [header-5](#header-5)
./ShellcodeFluctuation.exe payload.bin 2

🔭​ Technical Details

🗄️​ Architecture

The tool uses three global structures to manage state:

• FluctuationMetadata: Tracks shellcode address, size, encryption state, and XOR key
• HookedSleep: Stores original Sleep() function pointer and prologue bytes
• TypeOfFluctuation: Enum controlling operational mode main.c:250-261

🩻​ How It Works

• Injection: Allocates memory with VirtualAlloc(), copies shellcode, sets PAGE_EXECUTE_READ protection
• Hooking: Installs inline trampoline on Sleep() API to intercept calls
• Fluctuation: On each Sleep() call from shellcode thread:
• Encrypts shellcode with XOR
• Changes memory protection to PAGE_READWRITE or PAGE_NOACCESS
• Calls original Sleep()
• Decrypts and restores PAGE_EXECUTE_READ
• Exception Handling (Mode 2): VEH catches access violations and decrypts on-demand main.c:93-99

🖥️​ System Requirements

• Target: Windows 7+ (x64)
• Build: Linux with MinGW-w64
• Dependencies: kernel32.dll, ntdll.dll (standard Windows libraries)

⛔​🚫​🚭​ Security Notice

⚠️ For educational and authorized security research only. Unauthorized use of shellcode injection tools is illegal. Use only in controlled environments with proper authorization.

📜​ License

GPL v3

✒️​ Autor:

mgeeky the original code you can find here: https://github.com/mgeeky/ShellcodeFluctuation

🖋️ i only ported to C