How longwayhomie/polyengine works
PolyEngine is a Windows PE packer with a command-line Builder and a GUI front end. Its main workflow accepts a PE, DLL, or raw shellcode; prepares a packed loader and payload; optionally applies identity metadata and signing; and emits an executable whose embedded stub handles runtime loading. The README documents additional loader, evasion, and OPSEC options. The map reflects those documented capabilities and the sampled files; several internal call relationships are not visible in the excerpts, so uncertain links are omitted.
Main entry points: Builder.cpp Builder CLI · Stub.cpp Embedded loader · app.cpp App state · main.cpp GUI application
Components 24
GUI
- GUI application
GUI/src/main.cpp - Build screens
GUI/src/screens.cpp - App state
GUI/src/app.cpp - GUI services
GUI/src/services.cpp - Profiles and history
GUI/src/services.cpp
Build pipeline
- Builder CLI
Builder/Builder.cpp - Metadata cloning
Builder/CloneMeta.cpp - PE signing
Builder/PeSigning.cpp - UAC manifest
Builder/UacManifest.cpp
Packing engine
- PE construction
Engine/PeBuilder.c - PE loader
Engine/RunPE.c - Compression
Engine/Compression.c - Payload crypto
Engine/Crypto.c - Stub mutation
Engine/MutationEngine.c
Loader runtime
- Embedded loader
Stub/Stub.cpp - Payload execution
Stub/Payload.c - Sandbox checks
Stub/Evasion.cpp - OPSEC controls
Stub/Opsec.c - Syscall support
Stub/Syscalls.c - Module stomping
Stub/ModuleStomping.c - API unhooking
Stub/Unhooker.c
Other components
- Operator
- Timestamp service
- Packed executable
Connections 24
- Operator → GUI application: uses
- GUI application → Build screens: renders
- Build screens → App state: edits configuration
- App state → GUI services: starts build
- App state → Profiles and history: loads and saves
- GUI services → Builder CLI: launches CLI
- Operator → Builder CLI: runs CLI
- Builder CLI → PE construction: constructs loader
- Builder CLI → Compression: prepares payload
- Builder CLI → Payload crypto: encrypts payload
- Builder CLI → Stub mutation: mutates decryptor
- Builder CLI → Metadata cloning: clones metadata
- Builder CLI → UAC manifest: embeds manifest
- Builder CLI → PE signing: signs output
- Builder CLI → Packed executable: writes
- Timestamp service → PE signing: timestamps
- Packed executable → Embedded loader: contains
- Embedded loader → Sandbox checks: checks environment
- Embedded loader → OPSEC controls: applies controls
- Embedded loader → API unhooking: restores code
- Embedded loader → Module stomping: selects loading mode
- Embedded loader → Payload execution: dispatches payload
- Payload execution → PE loader: loads PE payload
- Syscall support → Embedded loader: supports native calls