CustomRDI

A from-scratch rewrite of Stephen Fewer's reflective DLL loader, with djb2 hashing, indirect syscalls, forwarder handling, and per-section memory permissions.

This is a learning project, not operational tooling. See the accompanying blog post for a full walkthrough: https://iliascyber.com

Credit

The reflective DLL injection technique is Stephen Fewer's (https://github.com/stephenfewer/reflectivedllinjection, 2012, BSD 3-clause). This project keeps Rva2Offset and GetReflectiveLoaderOffset from his original code (in loader.c), plus the supporting type definitions in CustomDLLInjection.h and CustomLoader.h. Everything else has been rewritten.

Build

From an x64 Native Tools Command Prompt for Visual Studio:

build.bat

Produces loader.exe and payload.dll.

Run

loader.exe payload.dll

A message box pops up confirming the payload's DllMain ran inside the reflectively-loaded image.

Limitations

This is a learning loader, not a full replacement for the Windows loader. TLS callbacks, API Set Schema resolution, x64 unwind metadata, loader-list registration, and bound/delay-load imports are all not implemented. See the blog post for details.

License

BSD 3-clause. See LICENSE. Includes code derived from Stephen Fewer's reflective_dll_injection project, also BSD 3-clause.