---

Three Stage Loader

A three-stage shellcode loader that demonstrates memory protection manipulation for evasion. This project splits the execution flow across three separate executables to minimize detection signatures.

Overview

The loader operates in three distinct phases, each with its own executable:

1. Stage 1: Downloads shellcode and allocates it with PAGE_READWRITE protection
2. Stage 2: Changes memory protection to PAGE_EXECUTE_READ to enable execution
3. Stage 3: Executes shellcode, then reverts protection to PAGE_READONLY to hide

Components

Stage 1: Loader (loader.exe)

• Downloads shellcode from a remote HTTP server
• Allocates memory with PAGE_READWRITE protection
• Creates shared memory to communicate shellcode location
• Runs continuously, waiting for execution commands

Stage 2: Protector (protector.exe)

• Connects to Stage 1 via shared memory
• Changes memory protection from READWRITE to EXECUTE_READ
• Exits after changing permissions

Stage 3: Executor (executor.exe)

• Finds and connects to running loader
• Creates remote thread to execute shellcode
• Changes protection back to READONLY after execution
• Can be run multiple times (execution counter increments)

Features

• Memory Protection Cycling: RW → RX → RO to minimize detection
• Shared Memory Coordination: Processes communicate via memory-mapped files
• Automatic Loader Discovery: Stage 3 can find running loaders automatically
• Re-executable: Shellcode can be run multiple times with protection toggling
• HTTP Payload Delivery: Remote shellcode fetching

Usage

1. Configure the URL:

#define SHELLCODE_URL "http://your-server/payload.bin"

---

❗Disclaimer

This tool is for educational purposes only. Use only in environments you own or have explicit permission to test. The authors are not responsible for any misuse.