Skip to main content
Glama
DansPK

Kali MCP

by DansPK

shellcode_to_exe

Convert raw shellcode from a file into a Windows executable for execution. Use when you have shellcode from Cobalt Strike, custom C, or malware extraction and need to package it as an EXE.

Instructions

Convert raw shellcode from a file into a Windows executable. Use when you have shellcode from another source (Cobalt Strike, custom C code, or extracted from malware) and need to package it as an EXE for execution. Output: path to the generated executable file.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
archNoArchitecture of the shellcode: x86 (32-bit, default) or x64 (64-bit)
outfileNoOutput executable path (default: auto-generated temp file)
shellcode_fileYesPath to file containing raw shellcode bytes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It clearly discloses the main behavior—converting raw shellcode into a Windows executable and returning its path—but it does not clarify whether the tool executes the shellcode, how it handles an existing output file, or any side effects beyond generating a file. This leaves some behavioral ambiguity for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately short and front-loaded: it states the core conversion in the first sentence, gives usage context in the second, and explicitly lists the output in the final phrase. Every sentence earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple file-conversion tool, the description provides the necessary context: what it converts, when to use it, and what it returns. It compensates for the lack of an output schema by explicitly reporting the output path. Minor gaps include not mentioning prerequisites or failure behavior, but these are not critical for an agent choosing and invoking the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters are already documented in the input schema with 100% coverage, so the baseline is 3. The description adds little parameter-specific meaning beyond indicating the shellcode comes from a file and that the output is a path to a generated executable; the schema already covers arch defaults and output path behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb and resource: 'Convert raw shellcode from a file into a Windows executable.' This clearly identifies what the tool does and differentiates it from sibling payload-generation tools like msfvenom or evasive_payload, since the shellcode is expected to come from an external source.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: 'Use when you have shellcode from another source... and need to package it as an EXE for execution.' This provides solid when-to-use context and implies that this tool is not for generating shellcode, though it does not explicitly name alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.