D7EAD/mkPIVM

v2.0.0 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 1mo Offensive & Pentesting

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

cobalt-strike edr evasion exploit exploitation havoc

+11 more

malware metasploit mythic obfuscation penetration-testing research reverse-engineering shellcode sliver virtual-machine virtualization

Summary

AI summary

Added polymorphism improvements and a --rx flag to run encrypted blobs from execute‑read memory without RWX.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Low	Supports two methods to obtain VirtualProtect pointer: PEB walker or loader argument. Supports two methods to obtain VirtualProtect pointer: PEB walker or loader argument. Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Low	Adds `--rx` flag to produce executable blobs without RWX permissions. Adds `--rx` flag to produce executable blobs without RWX permissions. Source: llm_adapter@2026-06-04 Confidence: low	—
Feature	Low	Adds `--rx` flag for blobs running from PAGE_EXECUTE_READ memory. Adds `--rx` flag for blobs running from PAGE_EXECUTE_READ memory. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Feature	Low	Keeps data island encrypted at rest, decrypts in-place during state_init. Keeps data island encrypted at rest, decrypts in-place during state_init. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—

Full changelog

added a bunch of polymorphism improvements.

added --rx. produces a blob that runs from PAGE_EXECUTE_READ memory, no
RWX needed. data island stays encrypted at rest and gets decrypted in-place
at state_init via VirtualProtect-RW/decrypt/VirtualProtect-RX.

two ways to get the VirtualProtect pointer, see /examples for basic example loaders:

default: in-blob PEB walker resolves it, gs:[0x60] -> Ldr -> kernel32 by
BaseDllName hash, then EAT walk for VirtualProtect by name hash. per-seed
salt on the hash so the embedded constants vary per build.
--rx-loader-vp: loader passes it in as the blob's first arg. rcx on x64,
__cdecl [esp+4] on x86. smaller blob, no PEB-walk fingerprint.

still no linux tests, will do later in 2.1.0.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track D7EAD/mkPIVM

Get notified when new releases ship.

About D7EAD/mkPIVM

All releases →