Files and Folders Commands
Offsets and addresses accept decimal or hexadecimal input (a 0x or $ prefix means hex). Commands that return an address or size store it in decimal. Raw byte payloads (the data for putcode and the result of getcode) are HEX byte strings, not numbers.
delfile <filename> - Deletes the specified file.
copyfile <source>, <destination> - Copies a file from source to destination. A trailing $ in a path expands to the application directory.
addlog <filename>, <string> - Appends a string as a new line to the specified log file.
shell <filename> - Executes an external EXE file (without waiting; see the run command to wait and capture the exit code).
putcode <offset>, <HEX_Stub> - Writes a sequence of HEX bytes at the specified offset.
getcode <offset>, <length>, <accumulator> - Reads bytes from the file into the accumulator as a HEX string.
getfile <accumulator> - Loads the entire output file content into the accumulator.
getfilelength <filename>, <accumulator> - Stores the file size (decimal) in the accumulator. If only one parameter is given, it is the accumulator and the output file is measured.
getoem <accumulator> - Reads the OEM Info string from the DOS header.
setoem <text> - Writes a new OEM Info string to the DOS header.
getoep <acc_raw>, <acc_rva> - Retrieves the Original Entry Point: raw file offset and RVA (both decimal).
setoep <rva> - Sets a new Entry Point address (RVA).
getimagebase <accumulator> - Retrieves the ImageBase address (decimal).
createsection <name>, <size>, <acc_file_offset>, <acc_virtual_addr> - Creates a new PE section and stores its raw offset and RVA.
setflag <flags> - Applies characteristics flags to all sections (use a 0x prefix for a hex bitmask).
invert <value>, <accumulator> - Encodes a value as a little-endian 4-byte HEX string (for example 0x00401011 becomes 11104000; used for building push/call addresses). pack <value>, dword, le, <acc> is the clearer equivalent.
xorcode <rva>, <length>, <accumulator> - XORs <length> bytes at the given RVA with a random key, writes them back, and stores a ready-to-use decoder stub (HEX) in the accumulator.
createpath <path> - Creates a full directory tree.