// shellcraft_winexec demonstrates winpwn's first shellcraft template:
// position-independent x64 shellcode that resolves kernel32 via the PEB
// (no leak/hardcoded base needed) and calls WinExec. Useful as the payload
// at the end of a ROP chain, or to drop directly into a hijacked function
// pointer / vtable entry.
package main

import (
	"fmt"
	"log"
	"winpwn"
)

func main() {
	code, err := winpwn.ShellcodeWinExec("putty.exe")
	if err != nil {
		log.Fatal(err)
	}
	fmt.Printf("%d bytes of shellcode, ready to splice into a payload:\n%x\n", len(code), code)

	// Validating it actually runs (rather than just trusting the bytes)
	// before landing it via a real exploit primitive:
	if err := winpwn.ExecuteShellcode(code); err != nil {
		log.Fatal(err)
	}
}