PAGES
← all tools
◆ Exploitation & C2

sickle-pdk

v4.0.0 open-source

Payload development kit for shellcode generation, formatting, execution, disassembly, bad character identification, and diffing across multiple architectures.

source ↗ rss ↗ What is a cyber toolchain?

Summary

sickle-pdk is an open-source payload development kit for shellcode work, run as a command-line tool, and free to use. It converts assembly to opcodes and back, formats shellcode for a target language, executes generated payloads for testing, identifies bad characters, and performs linear disassembly and diffing on binaries or stubs, with shellcode generation itself handled through the Keystone engine. It's aimed at exploit developers and red teamers who write or study shellcode across Windows, Linux and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. targets, offering built-in stubs for reverse shells, egg-hunters, VirtualAlloc-based execution, reflective loaders and kernel-level techniques rather than requiring each to be hand-assembled. No comparable tool is named in its own material, but it sits in the payload-development corner of exploitation tooling. First committed in 2017, it has stayed active with 8 contributors, 92 commits and 16 releases in the past year, though the most recent release was over seven months ago.

Payload development kit for shellcode generation, formatting, execution, disassembly, bad character identification, and diffing across multiple architectures.

How sickle-pdk helps

Does this shellcode contain bytes that will break my exploit's input path?

scans the generated or supplied opcodes against a list of characters you specify in one pass and flags every offset where one occurs

What machine code does this assembly actually assemble to, and can I get back from bytes to instructions?

converts between assembly and opcodes in both directions, so a written stub can be turned into raw bytecode or a captured payload can be read back as instructions

Does this stub actually pop a shell before I burn it in an exploit chain?

wraps the raw shellcode in a minimal runner and executes it directly on Windows or Unix, skipping the manual compile-wrapper-compile-run cycle

What changed between these two versions of a shellcode stub?

diffs two stubs at the assembly level, the opcode level, or as raw hexdumps, and shows where the instructions or bytes diverge

What instructions are hiding in this raw binary blob?

performs linear disassembly over a raw binary file via Capstone and prints the recovered assembly, without relying on section headers or metadata

Do I have to hand-write a reverse shell or loader for this architecture, or is there a stub already?

ships built-in payloads for reverse shells, egg-hunters, VirtualAlloc-based execution, reflective PE/ELF loaders and kernel-level techniques across Windows, Linux and ARM targets, selectable instead of assembling one from scratch

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities · 1 backed by code, an API document or a real run

Built from sickle-pdk's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What sickle-pdk offers you

  • Command-line interface1
  • Plugin system1
All capabilities 8 capabilities
Shellcode stub generation shipped Generates shellcode stubs for specific architectures and execution techniques, including reverse shells, reflective loaders, token stealers, and egg hunters. 18 releases · 1 other source · first seen Dec 2024

release 18 total

  • New shellcode stub: windows/x64/egghunter — egg-hunter technique for x64 Windows. v4.0.0 · Oct 2025 · source · release history
  • New shellcode stub: windows/x64/reflective_pe_loader — reflective PE loader for x64 Windows. v4.0.0 · Oct 2025 · source · release history
  • New shellcode stub: windows/aarch64/shell_reverse_tcp — reverse shell for Windows on ARM64. v4.0.0 · Oct 2025 · source · release history
  • New shellcode stub: windows/x64/virtualalloc_exec_https — VirtualAlloc-based exec over HTTPS for x64 Windows. v4.0.0 · Oct 2025 · source · release history
  • New shellcode stub: windows/x64/virtualalloc_exec_tcp — VirtualAlloc-based exec over TCP for x64 Windows. v4.0.0 · Oct 2025 · source · release history
  • Adds windows/aarch64/shell_reverse_tcp shellcode stub for Windows AArch64 targets. v4.0.0-Beta · Aug 2025 · source · release history

example

  • Generate a Linux AArch64 reflective ELF loader payload for in-memory execution over TCP. sickle generate -p linux/aarch64/memfd_reflective_elf_tcp v3.1.0 · Dec 2024 · source
Shellcode payload execution verified Accepts shellcode as a payload argument for use during execution. 1 release · 3 other sources · first seen Aug 2024

Also counts toward: Command-line interface

release

  • Supports specifying all bad characters on a single input argument (e.g. -b"\x00\x0a\x0d") instead of requiring separate passes. v2.0.2 · Aug 2024 · source · release history

command line

example

  • Identify all common bad characters in one pass rather than running the tool multiple times. sickle -b"\x00\x0a\x0d" v2.0.2 · Aug 2024 · source
Exit technique selection shipped Allows selection of exit techniques (EXITFUNC) for controlled shellcode exit behavior. 1 release · first seen Oct 2025

release

  • Adds EXITFUNC support to select payloads for controlled shellcode exit behavior. v4.0.0 · Oct 2025 · source · release history
Staged payload delivery shipped Provides built-in handler modules for staged payloads, replacing external workflows like Netcat for second-stage stub delivery. 1 release · first seen Oct 2025

release

  • Adds built-in handler module for staged payloads, replacing the Netcat workflow for second-stage stub delivery. v4.0.0 · Oct 2025 · source · release history
Interactive opcode generation shipped Provides an interactive module for generating opcodes directly from ASM instructions. 1 release · first seen Dec 2024

release

  • Adds asm_shell module for interactive opcode generation directly from ASM instructions. v3.1.0 · Dec 2024 · source · release history
Windows registry invocation shipped Registers the cyber tooling in the Windows registry to enable easier local invocation on Windows hosts. 1 release · first seen Aug 2024

release

  • Adds a Windows registry key entry for easier invocation on Windows hosts. v2.0.2 · Aug 2024 · source · release history
Bad character set generation shipped Provides a module for generating bad character sets to aid in payload encoding or evasion. 1 release · first seen Nov 2019

release

  • Adds the badchar module for generating bad character sets v2.0.2-beta · Nov 2019 · source · release history
Plugin module development shipped Allows users to implement new formats and development modules via drop-in support. 1 release · first seen May 2019

Also counts toward: Plugin system

release

  • Adds support for drop in modules allowing users to implement new formats and development modules v2.0 · May 2019 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for sickle-pdk, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail sickle-pdk puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

6 entries

  1. October 20251
  3. August 20251
  5. December 20241
  7. August 20241
  9. November 20191
  11. May 20191
    Show

    6 entries

    1. v4.0.0 Oct 13, 2025 · release notes

      Sickle v4 adds new Windows shellcode stubs, a built-in handler module, and EXITFUNC support for staged payloads.

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.0.0 https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:
$ git checkout v4.0.0
      • Adds built-in handler module for staged payloads, replacing the Netcat workflow for second-stage stub delivery.
      • New shellcode stub: windows/aarch64/shell_reverse_tcp — reverse shell for Windows on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..
      • New shellcode stub: windows/x64/egghunter — egg-hunter technique for x64 Windows.
      • New shellcode stub: windows/x64/virtualalloc_exec_tcp — VirtualAlloc-based exec over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. for x64 Windows.
      • New shellcode stub: windows/x64/virtualalloc_exec_https — VirtualAlloc-based exec over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. for x64 Windows.
      +2 more show less
      • New shellcode stub: windows/x64/reflective_pe_loader — reflective PE loader for x64 Windows.
      • Adds EXITFUNC support to select payloads for controlled shellcode exit behavior.

      7 details in Everything

    2. v4.0.0-Beta Prerelease Aug 13, 2025 · release notes

      sickle-pdk v4.0.0-Beta adds four new shellcode stubs including an x64 reflective PE loader and AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. reverse shell.

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.0.0-Beta https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:
$ git checkout v4.0.0-Beta
      • Adds windows/aarch64/shell_reverse_tcp shellcode stub for Windows AArch64 targets.
      • Adds windows/x64/egghunter shellcode stub for x64 egg-hunting payloads.
      • Adds windows/x64/virtualalloc_exec_tcp shellcode stub for x64 VirtualAlloc-based execution over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it..
      • Adds windows/x64/reflective_pe_loader shellcode stub for in-memory reflective PE loading on x64.

      4 details in Everything

    3. v3.1.0 Dec 17, 2024 · release notes

      Sickle v3.1.0 adds 9 new shellcode stubs across Windows/Linux/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. and an interactive ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. shell module.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.1.0 https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:
$ git checkout v3.1.0
      └──▷ TRY IT
      Generate a Linux AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. reflective ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. loader payload for in-memory execution over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it..
      $ sickle generate -p linux/aarch64/memfd_reflective_elf_tcp
      • Adds windows/x64/kernel_token_stealer shellcode stub for Windows x64 kernel token stealing.
      • Adds windows/x64/kernel_sysret shellcode stub for Windows x64 SYSRET-based exploitation.
      • Adds windows/x64/kernel_ace_edit shellcode stub for Windows x64 kernel ACE manipulation.
      • Adds windows/x64/shell_reverse_tcp shellcode stub for Windows x64 reverse TCP shells.
      • Adds windows/x86/kernel_token_stealer shellcode stub for Windows x86 kernel token stealing.
      +5 more show less
      • Adds linux/aarch64/memfd_reflective_elf_tcp shellcode stub for reflective ELF loading over TCP on Linux AArch64.
      • Adds linux/aarch64/shell_reverse_tcp shellcode stub for Linux AArch64 reverse TCP shells.
      • Adds linux/x64/memfd_reflective_elf_tcp shellcode stub for reflective ELF loading over TCP on Linux x64.
      • Adds linux/x86/shell_reverse_tcp shellcode stub for Linux x86 reverse TCP shells.
      • Adds asm_shell module for interactive opcode generation directly from ASM instructions.

      10 details in Everything

    4. v2.0.2 Aug 14, 2024 · release notes

      sickle-pdk v2.0.2 adds Windows registry key support and detects all bad characters from a single input flag.

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.0.2 https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:
$ git checkout v2.0.2
      └──▷ TRY IT
      Identify all common bad characters in one pass rather than running the tool multiple times.
      $ sickle -b"\x00\x0a\x0d"
      • Supports specifying all bad characters on a single input argument (e.g. -b"\x00\x0a\x0d") instead of requiring separate passes.
      • Adds a Windows registry key entry for easier invocation on Windows hosts.
      • Re-focuses supported architecture targets to x86, x64, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware..

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The Sickle subdirectory has been renamed to sickle (lowercase), which may break paths, scripts, or imports that reference the old casing.
      • !module() classes have been renamed to FormatModule() classes, which will break any custom modules or plugins that subclass or reference the old class name.
    5. v2.0.2-beta Prerelease Nov 25, 2019 · release notes

      Adds badchar module and allows modules to invoke formatting submodules in sickle-pdk v2.0.2-beta.

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.0.2-beta https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:
$ git checkout v2.0.2-beta
      • Adds the badchar module for generating bad character sets
      • Adds Windows console color support

      2 details in Everything

    6. v2.0 May 22, 2019 · release notes

      Sickle PDK v2.0 introduces a redesigned core architecture enabling drop-in modules for new formats and development capabilities

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.0 https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:
$ git checkout v2.0
      • Adds support for drop in modules allowing users to implement new formats and development modules

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in wetw0rk/sickle-pdk, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −1 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 0 of 2 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 873
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback