Encode techniques

← maldev README · docs/index

The encode/ package provides transport-safe byte transformations: Base64 (standard + URL-safe), UTF-16LE, ROT13, and the PowerShell -EncodedCommand format. Encoding is never confidentiality — it survives channels that mangle arbitrary bytes (HTTP headers, JSON strings, PowerShell command lines, stdin pipes).

TL;DR

flowchart LR
    PT[plaintext] -->|encrypt| ENC[crypto.EncryptAESGCM]
    ENC -->|then encode| B64[encode.Base64Encode]
    B64 --> WIRE[ship over HTTP / JSON / PS]
    WIRE -.unwrap.-> B64D[encode.Base64Decode]
    B64D --> DEC[crypto.DecryptAESGCM]
    DEC --> PAYLOAD[shellcode]

Encrypt first, then encode. Decode last, then decrypt.

Packages

Quick decision tree

MITRE ATT&CK

See also

• crypto — confidentiality layer (encrypt before encoding).
• Operator path: stagers and encoders
• Detection eng path: -EncodedCommand hunting