Dr Jekyll Mr Hyde

A Practical Look at the Dr Jekyll Mr Hyde Framework

The Dr Jekyll Mr Hyde tool is a binary transformation engine used primarily in red team engagements. It takes an existing executable and applies a series of metamorphic transformations to it. The output is functionally identical to the original but presents as a different signature to signature-based detection systems. This matters because traditional AV solutions rely heavily on static hashes and known patterns, which this tool systematically disrupts. At its core, the framework operates by parsing the PE structure of a Windows executable, then iterating through a pipeline of transformation passes. Each pass modifies the binary in a way that preserves execution semantics while altering the byte-level representation. Common transformations include instruction substitution, dead code insertion, control flow flattening, and register reallocation. The key insight most people miss is that not all transformations are created equal. Some preserve the original entry point structure, which makes the output easier to debug but also easier to detect through behavioral analysis. I spent weeks trying to get consistent results with the default configuration and kept hitting dead ends. The problem was that certain transformation combinations were corrupting DLL imports in a subtle way. The binary would run fine on my local machine but fail immediately when executed from a network share due to how the loader resolved paths after the metamorphic pass. I ended up disabling the aggressive control flow flattening option and keeping only the instruction substitution and dead code insertion layers enabled. That alone got me from roughly 40 percent success rate to something closer to 85 percent across different executable types.

Setting Up and Running the Tool

You will need a working Go development environment since the framework is written in Go. Clone the repository from the official source, compile it with go build, and place your target executable in the input directory. The basic command structure looks like this: run the tool specifying the input binary, choose your desired transformation depth, and point it at an output location. Transformation depth controls how many iterative passes are applied. Higher depths produce more variation but also increase the chance of structural damage to the binary. In practice, a depth between three and five covers most use cases without introducing instability. The tool generates multiple output variants per run. It does not produce a single result. This is intentional. You get a folder of transformed binaries and you test each one against your target environment. I usually take the first three variants that survive my local execution check and move those forward for deployment testing. The rest become reference material if something goes wrong later and you need to compare structures.

What Beginners Get Wrong

Most people assume this tool is a magic bullet for AV evasion. It is not. It handles signature-based detection very effectively. It does nothing against heuristic analysis, behavioral monitoring, or endpoint detection platforms that track process creation chains and API call patterns. If your red team engagement involves EDR solutions like CrowdStrike or SentinelOne, transforming the binary with Dr Jekyll Mr Hyde will change the hash but it will not stop the endpoint agent from flagging suspicious behavior. I learned this the hard way during an engagement where I spent two days perfecting a transformed payload only to watch it get killed within four seconds of execution by a behavioral rule that tracked the process injection pattern. The transformation was irrelevant to the actual detection trigger. Another common mistake is using the tool on packed or already-obfuscated binaries. The framework assumes a reasonably clean PE structure. If you feed it a UPX-packed executable, the parser will fail or produce garbage output. Strip the packer first, transform, then reapply packing if needed. This adds time but prevents a lot of wasted iterations.

Practical Considerations and Limitations

The tool works best against legacy signature-based AV solutions. In environments running modern endpoint protection, the value shifts from evasion to operational security through obfuscation. A transformed binary complicates analysis for defenders who rely on reverse engineering known malware samples. It adds friction to their workflow even if it does not guarantee detection avoidance. Execution time scales with transformation depth. A depth of three on a modest executable might take under a minute. A depth of seven on a larger application can run fifteen to twenty minutes depending on your hardware. There is no way around this. The transformations are computationally expensive by design. If you need speed, accept lower depth values and more output variants. If you need maximum variation, accept the longer compile times. One thing the documentation does not make clear is that some transformations are not reversible. Once you apply certain instruction substitutions, deobfuscating the output back to the original becomes non-trivial. If you need to maintain a clean copy for comparison or debugging, keep the original binary in a separate directory and never overwrite it. I lost a working exploit chain once because I had transformed over the original and then needed to roll back a change. The lesson was obvious but painful to learn.

Where to Get It

The tool is available through the standard public repositories. Search for Dr Jekyll Mr Hyde on GitHub and you will find the official project page. Download the source, compile from source rather than using pre-built binaries, and verify the build with checksums. Pre-compiled versions circulate on various file-sharing sites and there is no reason to risk running someone else built version when compilation takes ten minutes. The framework is a legitimate utility for authorized security testing. Using it against systems you do not have explicit permission to test is illegal and carries serious consequences. The tool itself is not controversial among professionals who understand its scope. The controversy comes from people applying it outside the bounds of responsible security research. Keep your engagements within contractual boundaries and document everything. That is the part nobody talks about but it is the difference between a career and a criminal record. If you are new to this, start small. Transform a benign utility like calc.exe or notepad.exe and observe the output. Check that the transformed version runs correctly. Compare the PE structures using a tool like PEView or Ghidra. Understanding what changed helps you understand what might break when you apply it to something more complex. Skipping this step and jumping straight to live payloads is how people end up with broken tools in production environments.