Experimentos con la reflectiva dll para meterle un stub en las cabeceras DOS - GitHub - g4ngli0s/MyReflectiveDLL: Experimentos con la reflectiva dll para meterle un stub en las cabeceras DOS

Friday, August 11, 2023

Reflective DLL After some time spent on implementing a Reflective DLL and its beloved Loader/Injector I thought that it could have been a very great first topic for what it might become a long-ish ser...

TL;DR Implant with our encrypted DLL -> allocates memory for the DLL -> put the decrypted DLL into that memory space -> find the offset of the exported ReflectiveLoader function

A very common technique used by threat actors as well as Red Teams is Process Injection. Nowadays, this technique is getting detected very accurately by EDR vendors - more and more often via Kernel ev...