tabby — a C framework for generating position‑independent shellcode for Windows x64

The framework is designed for developing native C-based shellcode. The final output is a self‑contained blob that can be injected into any Windows process, featuring EDR evasion through indirect NT syscalls.

Why it matters: • Small codebase: around 500 lines of C and 80 lines of NASM. • Compiles C shellcode with full PIC compatibility (it can be executed from any memory address) using a custom linker script. • The output is a shellcode.bin file without a PE header, IAT/imports, or CRT. • Built entirely on Linux: mingw-w64 + nasm + linker script + objcopy (no MSVC/Windows SDK/Wine required).

Tool: https://github.com/cocomelonc/tabby