beignet

README

Beignet

Donut for MacOS, converts darwin/arm64 and darwin/amd64 .dylib files into MacOS PIC shellcode, can be used as a CLI or imported as a golang library.

CLI

Convert a dylib to a raw shellcode buffer:

./beignet --out payload.bin ./payload.dylib

Optionally compress the staged dylib with aPLib (AP32):

./beignet --compress --out payload.bin ./payload.dylib

Comple from Source

make

Regenerating the embedded loader (darwin/arm64 + darwin/amd64)

go generate ./internal/stager

Documentation

Index

• Variables
• func DylibFileToShellcode(path string, opts Options) ([]byte, error)
• func DylibToShellcode(dylib []byte, opts Options) ([]byte, error)
• func LoaderCSource() string
• type Options

Variables

var (
	ErrUnsupportedArch = errors.New("beignet: unsupported architecture (supported: darwin/arm64, darwin/amd64)")
	ErrInvalidMachO    = errors.New("beignet: invalid Mach-O")
)

Functions

func DylibFileToShellcode

func DylibFileToShellcode(path string, opts Options) ([]byte, error)

func DylibToShellcode

func DylibToShellcode(dylib []byte, opts Options) ([]byte, error)

func LoaderCSource

func LoaderCSource() string

LoaderCSource returns the embedded darwin loader C source code.

Types

type Options

type Options struct {
	// EntrySymbol is the symbol name to resolve in the loaded module (e.g. "_StartW").
	// If provided without a leading underscore, one is added.
	EntrySymbol string

	// Compress enables aPLib "AP32" safe-packed compression for the staged dylib
	// buffer. This reduces shellcode size and requires the embedded loader.
	Compress bool
}