admin/AbishekPonmudi-Dynloader
1
0
Fork 0
mirror of https://github.com/AbishekPonmudi/Dynloader synced 2026-07-15 03:39:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
AbishekPonmudi
2026-07-10 11:22:52 -07:00
parent 9af54e9d0f
commit 057c5cdc5b
1 changed files with 12 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12 -31
View File
@@ -1,12 +1,14 @@
# Dynloader
**Modular Windows shellcode loader — C++20**
**Modular Windows loader using C++**
For **[usage](#usage)** and **[testing / demo](#demo)**.
---
## Overview
**Dynloader** is a research-oriented Windows loader for studying how shellcode is delivered, staged, and executed in both **local** and **remote** process contexts.
**Dynloader** is a research-oriented Windows loader for studying how payload is delivered, staged, and executed in both **local** and **remote** process contexts. The current version supports shellcode staging only — planned work is under **[Planned features](#planned-features)**.
It can:
@@ -77,24 +79,6 @@ What Dynveil provides:
- **Crypto** — AES-256-CBC key material, encrypt/decrypt, pack/unpack key blobs
- **HTTP transport** — minimal fileless client + in-memory server for lab delivery
Dynloader’s job on top of Dynveil:
- Parse CLI modes (local, remote, fileless, server, encrypt)
- Acquire shellcode (disk or network)
- Decide **local vs remote** ingestion
- Stage memory (W^X / section) and execute
- For remote: resolve PID/name, open process, optional headless spawn, inject
| Dynveil area | Path | Role |
|--------------|------|------|
| PE / PEB | `lib/pe/` | Manual PEB + LDR + EAT |
| API resolve | `lib/resolve/` | Dynamic hash-based APIs |
| Syscalls | `lib/syscall/` | Tartarus Gate indirect Nt\* |
| Memory | `lib/memory/` | Section map / staging helpers |
| Crypto | `lib/crypto/` | AES-256-CBC |
| Net | `lib/net/` | Fileless HTTP |
| Common | `lib/common/` | Hashes, logging, NT types |
---
## How it works
@@ -125,19 +109,16 @@ Same staging/execution ideas apply whether bytes came from disk or from the file
## Building
> Build steps TBD (Visual Studio / MSVC x64 C++20).
**Prerequisites:** Windows 10/11 x64, MSVC C++ toolchain (VS 2019/2022/18 or **Build Tools** with *Desktop development with C++*). Internet + admin only needed for first-time auto-install.
Reference pipeline after a successful build:
```bat
build.bat :: Release x64 → x64\Release\loader.exe
build.bat debug :: Debug x64
build.bat clean :: Clean
build.bat --install :: Install minimal VS Build Tools if missing, then build
```
1. Parse CLI (local / remote / fileless / server / encrypt)
2. Init Tartarus Gate (SSNs + indirect stubs)
3. Get shellcode
- disk file, or
- HTTP `GET /api/v1/payload` (+ `/api/v1/key` if AES)
4. If `--process` → remote ingestion (PID / name / headless spawn)
Else → local ingestion
5. Stage memory (indirect Nt\*, W^X)
6. Execute (`CreateThread` / `CreateRemoteThread`)
`build.bat` finds MSBuild via `vswhere`, picks a compatible toolset (`v145` / `v143` / `v142`), and builds `loader.sln`. On a machine with no compiler, `--install` pulls official Build Tools + C++ workload (winget or bootstrapper).
---