Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
PE-Obfuscator — PE obfuscator with Evasion in mind | Kitploit
Tools/GitHubGitHub/saadahla/pe-obfuscator
ExploitationPost-ExploitationRed TeamingPayload DevelopmentAdversarial Attack
GitHubsaadahla/pe-obfuscator

PE-Obfuscator

PE obfuscator with Evasion in mind

View Repository
212423 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

PE-Obfuscator

PE obfuscator with Evasion in mind , needs Admin Privilege in order to load RTCore64 driver.

Video:

https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4

The Obfuscator :

root@kitploit:~
- Gets xored Fileless PE from a remote server
- Drop the Loader in the disk 
- Add random section to that Loader
- Add the xored Fileless PE to the new created Loader section

The Loader :

root@kitploit:~
- Unhook ntdll from knowndlls
- Drop RTCore64 to the disk
- Load/Install RTCore64
- Exploit RTCore64 to Remove Kernel Callbacks
- xor PE
- Map/Load PE from the added Section
- Stomped a big module that fit the PE.

Credits :

https://br-sn.github.io/Removing-Kernel-Callbacks-Using-Signed-Drivers/
https://github.com/br-sn/CheekyBlinder
https://github.com/lawiet47/STFUEDR
https://papers.vx-underground.org/papers/Windows/Infection/2015-03-06%20-%20PE%20Infection%20-%20Add%20a%20PE%20section%20-%20with%20code.txt

Download Tool