oops

Overlord-Server/src/server/donut-manager.ts

@@ -199,11 +199,10 @@ export async function ensureDonut(
  * Flags used:
  *   -f 1   raw shellcode output (no base64/C/etc wrapping)
  *   -a 1|2 architecture (1=x86, 2=x64)
- *   -z 3   compress the embedded PE with LZNT1 — smaller payload + extra obfuscation
- *          NOTE: LZNT1 / Xpress / Xpress-Huffman compression uses Windows
- *          RtlCompressBuffer APIs, so it ONLY works when Donut runs on a
- *          Windows host. On Linux/macOS Donut, only -z 1 (none) and -z 2
- *          (aPLib) are supported and -z 3 will fail at compression time.
+ *   -z N   compression. LZNT1/Xpress/Xpress-Huffman (-z 3/4/5) use Windows
+ *          RtlCompressBuffer APIs and only work when Donut runs on a Windows
+ *          host. We pick the best available for the host: -z 3 (LZNT1) on
+ *          Windows, -z 2 (aPLib, cross-platform) elsewhere.
  *   -b 1   no AMSI/WLDP bypass — caller is responsible for evasion (e.g. SGN)
  *
  * Exit behavior defaults to "exit thread" (-x 1) when -x is omitted, which is
@@ -239,10 +238,11 @@ export async function runDonut(
   }
 
   const archFlag = arch === "386" ? "1" : "2";
+  const compressFlag = process.platform === "win32" ? "3" : "2";
 
   try {
     // -i flag required since donut v1 (previously positional arg)
-    const result = await $`${bin} -a ${archFlag} -z 3 -f 1 -b 1 -o ${outputBin} -i ${inputPe}`
+    const result = await $`${bin} -a ${archFlag} -z ${compressFlag} -f 1 -b 1 -o ${outputBin} -i ${inputPe}`
       .nothrow()
       .quiet();
     const stdout = result.stdout.toString().trim();