admin/AbishekPonmudi-Dynloader
1
0
Fork 0
mirror of https://github.com/AbishekPonmudi/Dynloader synced 2026-07-15 03:39:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
(Havox)
2026-07-10 13:14:07 -07:00
committed by GitHub
parent c3ba21aa32
commit ec7b4337ce
1 changed files with 27 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+27 -17
View File
@@ -2,20 +2,30 @@
**Modular Windows loader using C++** **Modular Windows loader using C++**
For **[usage](#usage)** and **[testing / demo](#demo)**. <div align="center">
<p align="center">
<img src="https://img.shields.io/badge/Language-C%2B%2B-blue" />
<img src="https://img.shields.io/badge/OS-Windows-blue" />
<img src="https://img.shields.io/badge/Maintained-Yes-brightgreen" />
</p>
<!-- ![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge) -->
</div>
For Workaround Check -> **[Building](#Building)**, **[usage](#usage)** and **[testing / demo](#demo)**.
--- ---
## Overview ## Overview
**Dynloader** is a research-oriented Windows loader for studying how payload is delivered, staged, and executed in both **local** and **remote** process contexts. The current version supports shellcode staging only — planned work is under **[Planned features](#planned-features)**. **Dynloader** is a research-oriented Windows loader for studying how payload is delivered, staged, and executed in both **local** and **remote** process contexts, the currect verison support only shellcode staging, Planned more implementation -> check out **[Planned features](#Planned-features)**.
It can: **It can:**
- Load shellcode from a local `.bin` file > - Load shellcode from a local `.bin` file
- Fetch shellcode **filelessly** over HTTP (optional AES-256-CBC at runtime) > - Fetch shellcode **filelessly** over HTTP (optional AES-256-CBC at runtime)
- Inject into a target by **PID** or **process name** > - Inject into a target by **PID** or **process name**
- Spawn a missing process **headless** (suspended + hidden), inject, then resume > - Spawn a missing process **headless** (suspended + hidden), inject, then resume
Core evasion and resolution primitives are provided by **[Dynveil](https://github.com/Abishekponmudi/dynveil)** (`lib/`) — a reusable library that implements PEB/PE parsing, API hashing, Tartarus Gate indirect syscalls, section mapping, AES crypto, and HTTP transport. Dynloader is the CLI + ingestion orchestration layer on top of Dynveil. Core evasion and resolution primitives are provided by **[Dynveil](https://github.com/Abishekponmudi/dynveil)** (`lib/`) — a reusable library that implements PEB/PE parsing, API hashing, Tartarus Gate indirect syscalls, section mapping, AES crypto, and HTTP transport. Dynloader is the CLI + ingestion orchestration layer on top of Dynveil.
@@ -118,7 +128,7 @@ build.bat clean :: Clean
build.bat --install :: Install minimal VS Build Tools if missing, then build build.bat --install :: Install minimal VS Build Tools if missing, then build
``` ```
`build.bat` finds MSBuild via `vswhere`, picks a compatible toolset (`v145` / `v143` / `v142`), and builds `loader.sln`. On a machine with no compiler, `--install` pulls official Build Tools + C++ workload (winget or bootstrapper). > `build.bat` finds MSBuild via `vswhere`, picks a compatible toolset (`v145` / `v143` / `v142`), and builds `loader.sln`. On a machine with no compiler, `--install` pulls official Build Tools + C++ workload (winget or bootstrapper).
--- ---
@@ -172,14 +182,14 @@ loader.exe payload.bin --verbose
loader.exe --process notepad payload.bin --verbose loader.exe --process notepad payload.bin --verbose
``` ```
If `notepad` is not running, Dynloader spawns it headless, injects, resumes. > If `notepad` is not running, Dynloader spawns it headless, injects, resumes.
>
- Target by **PID** or **process name** (e.g. `notepad` / `1234`) — supports many legitimate binaries in the same session without elevation (`!SeDebugPrivilege` not required for same-integrity targets) > - Target by **PID** or **process name** (e.g. `notepad` / `1234`) — supports many legitimate binaries in the same session without elevation (`!SeDebugPrivilege` not required for same-integrity targets)
- Process discovery via **`NtQuerySystemInformation`** (SystemProcessInformation) over Tartarus Gate > - Process discovery via **`NtQuerySystemInformation`** (SystemProcessInformation) over Tartarus Gate
- If the named process is **not running** → spawn **headless** (`CREATE_SUSPENDED` + no window), inject, then resume > - If the named process is **not running** → spawn **headless** (`CREATE_SUSPENDED` + no window), inject, then resume
- Remote stage: `NtAllocateVirtualMemory` → `NtWriteVirtualMemory` → `NtProtectVirtualMemory` (RX) > - Remote stage: `NtAllocateVirtualMemory` → `NtWriteVirtualMemory` → `NtProtectVirtualMemory` (RX)
- Remote run: hash-resolved `CreateRemoteThread` > - Remote run: hash-resolved `CreateRemoteThread`
- Open target prefers `NtOpenProcess`, falls back to hashed `OpenProcess` > - Open target prefers `NtOpenProcess`, falls back to hashed `OpenProcess`
### 4) Remote by PID ### 4) Remote by PID
@@ -217,7 +227,7 @@ Writes `.enc` + `.key` next to the input for lab packaging.
--- ---
## Planned features ## Planned-features
- **Manual PE loader** — full PE / DLL support alongside shellcode (`.bin`) - **Manual PE loader** — full PE / DLL support alongside shellcode (`.bin`)
- **Manual DLL loader / remote DLL ingestion** — map and run DLLs in local or remote processes without relying only on raw shellcode blobs - **Manual DLL loader / remote DLL ingestion** — map and run DLLs in local or remote processes without relying only on raw shellcode blobs