I made a RAT and experimented with shellcode loading. Things I found hard were obfuscating the app, learning how to use indirect syscalls and trying to evade detection. I am proud of getting my best attempt (tar2.0) at best to evade 4/71 detections which were primarily high positive ML engines and Crowdstrike (only 60% confidence) (this eventually increased to 9/71 due to signatures).
