From 83a539ac6051fcdfdbd6272b2a92a821f5856986 Mon Sep 17 00:00:00 2001 From: Winslow <33692631+senzee1984@users.noreply.github.com> Date: Fri, 8 Mar 2024 14:28:52 -0500 Subject: [PATCH] Update README.md --- README.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index ce9a95a..dfc72a2 100644 --- a/README.md +++ b/README.md @@ -105,9 +105,21 @@ Because InflativeLoading is in its early stage, not every exe is supported well. :white_check_mark: Native console program that has an interactive console/shell, like Mimikatz. +## Improvement Over ReflectiveLoader +:heavy_check_mark: No specific export functions are required, making it more friendly towards PE files for which the source code and compilation are not conveniently accessible + +:heavy_check_mark: Avoids unintended results due to differences between the PE file on disk and in memory + +:heavy_check_mark: Eliminates the need for conversion between the original file offset and RVA + +:heavy_check_mark: Avoids additional memory space allocation + +:heavy_check_mark: Avoids RWX memory regions. + +:heavy_check_mark: Even for RX memory regions, it does not start with the MZ characteristic, increasing the difficulty of investigation. + ## Capabilities - :ballot_box_with_check: Support for normal native EXE :ballot_box_with_check: Support for EXE that has Delayed Import Directory