The latest articles on DEV Community by Schich (@schich). https://dev.to/schich https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4030858%2Fb52a19dd-868c-4ff2-8ca9-891f7620240d.png https://dev.to/schich en Schich Wed, 15 Jul 2026 18:00:56 +0000 https://dev.to/schich/a-stealthy-and-efficient-way-for-just-in-time-payload-decryption-3e0o https://dev.to/schich/a-stealthy-and-efficient-way-for-just-in-time-payload-decryption-3e0o <p>I found A way to implement Just in time decryption into my stager project for redteaming. All just in time decryptors I found either decrypted the payload instruction after instruction (which is incredibly slow) or completely in total at start of payload execution (which gives basically no benefit). <br> Lucky-Spark decrypts a sliding windows of memory pages to keep performance high and still provide protection against memory detection and reverse engineering.<br> I want to share my code here to maybe help you with your pentest or readteaming project or to show you how to encrypt your "legitimate" project to secure your intellectual property.</p> <p>The project is not vibe coded and can be found here: </p> <div class="ltag-github-readme-tag"> <div class="readme-overview"> <h2> <img src="https://assets.dev.to/assets/github-logo-5a155e1f9a670af7944dd5e12375bc76ed542ea80224905ecaf878b9157cdefc.svg" alt="GitHub logo"> <a href="https://github.com/Schich" rel="noopener noreferrer"> Schich </a> / <a href="https://github.com/Schich/Lucky-Spark" rel="noopener noreferrer"> Lucky-Spark </a> </h2> <h3> A stealthy stager designed for shellcode payloads staged with http/https like Sliver, or on github raw. </h3> </div> <div class="ltag-github-body"> <div id="readme" class="md"><div class="markdown-heading"> <h1 class="heading-element">LUCKY-SPARK</h1> </div> <p>⟪ <strong>LUCKY-SPARK</strong> ⟫ is a stager designed for shellcode payloads staged with http/https like sliver or on github raw. It uses modern obfuscation and evaion methods like sliding window just-in-time decryption of the payload and cpu instruction patching By default it creates an executable masquarading as the filezilla ftp client.</p> <div class="markdown-heading"> <h2 class="heading-element">Features</h2> </div> <ul> <li> <strong>Staged Sliver Payload Loader</strong> Downloads and executes a Sliver payload from a specified server.</li> <li> <strong>JIT Shellcode Decryption</strong> Decrypts only a sliding windows of the payload to minimise exposure.</li> <li> <strong>Fiber-based Execution</strong> Runs shellcode within fibers for improved stealth and complicating analysis.</li> <li> <strong>Dynamic API Resolution</strong> Suspicious or detection-prone Windows API functions are dynamically loaded at runtime.</li> <li> <strong>String Obfuscation</strong> Sensitive strings (e.g., URLs, user agents) are encrypted using an <strong>affine cipher</strong> and stored obfuscated in the compiled binary.</li> <li> <strong>Cpu instruction patching</strong> The aes cpu instructions re hidden behind unsuspicious cpu instructions like pmulqd and patched after execution.</li> <li> <strong>Automatic Disguise</strong> EXE is…</li> </ul></div> </div> <div class="gh-btn-container"><a class="gh-btn" href="https://github.com/Schich/Lucky-Spark" rel="noopener noreferrer">View on GitHub</a></div> </div> pentest crypto cybersecurity showdev