diff --git a/Reflective_DLL_Injection/readme.md b/Reflective_DLL_Injection/readme.md index 500f80c..f85b2ef 100644 --- a/Reflective_DLL_Injection/readme.md +++ b/Reflective_DLL_Injection/readme.md @@ -1,10 +1,10 @@

Reflective DLL Injection

- CCIR + CCIR

## Overview -In this lab, we explore a Reflective DLL Injection technique. By loading the DLL directly from memory without touching the disk, it evades common detection mechanisms, making it a preferred method for sophisticated malware and offensive security operations. This technique allows to execute code within the context of another process without writing the DLL to disk. +In this lab, we explore a Reflective DLL Injection technique. This technique allows to execute code within the context of another process without writing the DLL to disk. By loading the DLL directly from memory without touching the disk, it evades common detection mechanisms, making it a preferred method for sophisticated malware and offensive security operations. ## Steps 1. `Read the DLL into Memory:` This step involves to read the DLL into memory buffer. @@ -153,6 +153,7 @@ This code execute the injected DLL's main entry point (DllMain). ## Full Code ### Loader/Injector Code +#### data.h ```cpp #pragma once #include @@ -170,6 +171,7 @@ typedef struct BASE_RELOCATION_ENTRY { using DLLEntry = BOOL(WINAPI*)(HINSTANCE dll, DWORD reason, LPVOID reserved); ``` +#### source.cpp ```cpp #include #include