• 设为首页
  • 点击收藏
  • 手机版
    手机扫一扫访问
    迪恩网络手机版
  • 关注官方公众号
    微信扫一扫关注
    迪恩网络公众号

bats3c/DarkLoadLibrary: LoadLibrary for offensive operations

原作者: [db:作者] 来自: 网络 收藏 邀请

开源软件名称(OpenSource Name):

bats3c/DarkLoadLibrary

开源软件地址(OpenSource Url):

https://github.com/bats3c/DarkLoadLibrary

开源编程语言(OpenSource Language):

C 98.4%

开源软件介绍(OpenSource Introduction):

DarkLoadLibrary

LoadLibrary for offensive operations.

How does it work?

https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/

Usage

DARKMODULE DarkModule = DarkLoadLibrary(
    LOAD_LOCAL_FILE, // control flags
    L"TestDLL.dll", // local dll path, if loading from disk
    NULL, // dll buffer to load from if loading from memory
    0, // dll size if loading from memory
    NULL // dll name if loaded from memory
);

Control Flags:

  • LOAD_LOCAL_FILE - Load a DLL from the file system.
  • LOAD_MEMORY - Load a DLL from a buffer.
  • NO_LINK - Don't link this module to the PEB, just execute it.

DLL Path:

This can be any path that CreateFileW will open.

DLL Buffer:

This argument is only needed when LOAD_MEMORY is set. In that case this argument should be the buffer containing the DLL.

DLL Size:

This argument is only needed when LOAD_MEMORY is set. In that case this argument should be the size of the buffer containing the DLL.

DLL Name:

This argument is only needed when LOAD_MEMORY is set. In that case this argument should be the name which the DLL should be set in the PEB under.

Considerations

The windows loader is very complex and can handle all the edge case's and intricacies of loading DLLs. There are going to be edge case's which I have not had the time to discover, reverse engineer and implement. So there's going to be DLLs that this loader simply will not work with.

That being said I plan on making this loader as complete as possible, so please open issue's for DLLs that are not correctly loaded.




鲜花

握手

雷人

路过

鸡蛋
该文章已有0人参与评论

请发表评论

全部评论

专题导读
热门推荐
阅读排行榜

扫描微信二维码

查看手机版网站

随时了解更新最新资讯

139-2527-9053

在线客服(服务时间 9:00~18:00)

在线QQ客服
地址:深圳市南山区西丽大学城创智工业园
电邮:jeky_zhao#qq.com
移动电话:139-2527-9053

Powered by 互联科技 X3.4© 2001-2213 极客世界.|Sitemap