praetorian-inc/wasmforge

WasmForge is a command line tool that takes programs written in Go, or existing C# projects, and compiles them into a single native binary that runs on Windows or macOS. Instead of running directly on the operating system, the guest program is compiled to WebAssembly and executed inside a sandboxed runtime built on a modified version of the wazero project. Even though the code runs inside this sandbox, it still gets access to networking, raw sockets, Windows APIs, and macOS framework APIs, so a normal Go program using net.Dial or net/http can be built without changing its source code. The project is built primarily for security researchers doing red team work. Its README is candid about what still does not work: a meaningful portion of the Windows Win32 API is unsupported, especially APIs that rely on callback thunks, and some operations will simply crash. The author gives the well known Sliver command and control framework as an example: many of its commands run through WasmForge, but the port is not complete, and small quirks remain, like file paths still showing forward slashes instead of the usual Windows backslash format. Support for compiling C# to this same format is described as more experimental than the Go path, often requiring parts of the program to be rewritten to work at all. WasmForge is aimed mainly at getting past static detection methods that scan a binary's contents, it is less effective against tools that inspect a running program's memory, and the README notes that obvious strings inside a binary can still trigger simple in-memory scans. You can get started by downloading a prebuilt release binary, using a bundled Docker image that includes the full .NET and WebAssembly toolchain needed for C# builds, or building from source with a single make command. A build command lets you target Windows or macOS, choose a raw sockets option, and pick a ghost profile that changes how the compiled binary's internal symbols look to reduce detection rates. The project openly acknowledges it was built with heavy use of AI coding tools, and the codebase is described by its own author as still somewhat disorganized in places.