sRDI – Shellcode Reflective DLL Injection

sRDI allows for the conversion of DLL files to position independent shellcode.

Functionality is accomplished via two components:

• C project which compiles a PE loader implementation (RDI) to shellcode
• Conversion code which attaches the DLL, RDI, and user data together with a bootstrap

This project is comprised of the following elements:

• ShellcodeRDI: Compiles shellcode for the DLL loader
• NativeLoader: Converts DLL to shellcode if necessary, then injects into memory
• DotNetLoader: C# implementation of NativeLoader
• Python\ConvertToShellcode.py: Convert DLL to shellcode in place
• Python\EncodeBlobs.py: Encodes compiled sRDI blobs for static embedding
• PowerShell\ConvertTo-Shellcode.ps1: Convert DLL to shellcode in place
• FunctionTest: Imports sRDI C function for debug testing
• TestDLL: Example DLL that includes two exported functions for the call on Load and after

The DLL does not need to be compiled with RDI, however, the technique is cross-compatible.

Building

Use

Convert DLL to shellcode using python

from ShellcodeRDI import *



dll = open("TestDLL_x86.dll", 'rb').read()

shellcode = ConvertToShellcode(dll)

Load DLL into memory using C# loader

DotNetLoader.exe TestDLL_x64.dll

Convert DLL with python script and load with Native EXE

python ConvertToShellcode.py TestDLL_x64.dll

NativeLoader.exe TestDLL_x64.bin

Convert DLL with powershell and load with Invoke-Shellcode

Import-Module .\Invoke-Shellcode.ps1

Import-Module .\ConvertTo-Shellcode.ps1

Invoke-Shellcode -Shellcode (ConvertTo-Shellcode -File TestDLL_x64.dll)

Copyright (c) 2013, Matthew Graeber
All rights reserved.

Source: https://github.com/monoxgas/