How klezvirus/inceptor works
Inceptor is a Windows template-based PE packer for penetration testers and red teams. The principal workflow starts with an operator selecting an input and options; the CLI configures an encoder chain and dispatches to a language-specific artifact generator, which transforms or embeds the payload, composes template code, and produces a binary or PowerShell artifact. Generators use compiler and configuration layers, with optional obfuscation and signing. Templates and modules provide documented AV/EDR-evasion capabilities. Edges reflect the README and indexed references; some implementation details were not sampled, so those links are omitted rather than inferred.
Main entry points: DotNetArtifactGenerator.py .NET generator · NativeArtifactGenerator.py Native generator · inceptor.py Inceptor CLI · CodeWriter.py Template writer
Components 17
Operator workflow
- Inceptor CLI
inceptor/inceptor.py - Configuration
inceptor/config/Config.py
Payload transformation
- PE converters
inceptor/converters/TransformerFactory.py - Encoder chain
inceptor/encoders/EncoderChain.py
Template composition
- Template writer
inceptor/engine/CodeWriter.py - Template modules
inceptor/engine/modules/TemplateModule.py - Loader templates
inceptor/templates/public
Artifact generation
- .NET generator
inceptor/generators/DotNetArtifactGenerator.py - Native generator
inceptor/generators/NativeArtifactGenerator.py - PowerShell generator
inceptor/generators/PowerShellArtifactGenerator.py - Compilers
inceptor/compilers/Compiler.py - Built artifact
Artifact customization
- Obfuscators
inceptor/obfuscators/Obfuscator.py - Code signing
inceptor/signers/CarbonCopy.py - Evasion techniques
inceptor/engine/modules - Syscall support
inceptor/syscalls
Other components
- Operator
Connections 26
- Operator → Inceptor CLI: configures
README.md - Inceptor CLI → Encoder chain: builds chain
inceptor/inceptor.py - Inceptor CLI → .NET generator: dispatches to
inceptor/inceptor.py - Inceptor CLI → Native generator: dispatches to
inceptor/inceptor.py - Inceptor CLI → PowerShell generator: dispatches to
inceptor/inceptor.py - Inceptor CLI → Template modules: selects modules
inceptor/inceptor.py - .NET generator → Configuration: reads settings
inceptor/generators/DotNetArtifactGenerator.py - Native generator → Configuration: reads settings
inceptor/generators/NativeArtifactGenerator.py - .NET generator → PE converters: selects converter
inceptor/generators/DotNetArtifactGenerator.py - Native generator → PE converters: selects converter
inceptor/generators/NativeArtifactGenerator.py - .NET generator → Encoder chain: encodes payload
inceptor/generators/DotNetArtifactGenerator.py - Native generator → Encoder chain: encodes payload
inceptor/generators/NativeArtifactGenerator.py - .NET generator → Template writer: writes source
inceptor/generators/DotNetArtifactGenerator.py - Native generator → Template writer: writes source
inceptor/generators/NativeArtifactGenerator.py - Template writer → Template modules: composes modules
- Template writer → Loader templates: uses templates
- .NET generator → Compilers: compiles output
inceptor/generators/DotNetArtifactGenerator.py - Native generator → Compilers: compiles output
inceptor/generators/NativeArtifactGenerator.py - .NET generator → Obfuscators: may obfuscate
inceptor/generators/DotNetArtifactGenerator.py - Native generator → Obfuscators: may obfuscate
- Native generator → Code signing: may sign
inceptor/generators/NativeArtifactGenerator.py - .NET generator → Code signing: may sign
inceptor/generators/DotNetArtifactGenerator.py - Compilers → Built artifact: produces binary
- PowerShell generator → Built artifact: generates script
- Template modules → Evasion techniques: embeds techniques
README.md - Evasion techniques → Syscall support: supports syscall methods