Stephen Fewer created the original ReflectiveDLLInjection. I decided to learn how to do it myself, with a cleaner codebase and added features.
I rewrote the sRDI project, but did not push it. The same goes for pe_to_shellcode. These projects are not that different from Stephen Fewer's one.
Some interesting facts stem from the way the executable code is extracted. The former makes use of a function link order while the latter make use of the masm_shc utility for producing shellcode.
Here are some schemas to understand PE parsing (there may be some errors).
[!] Images should be viewed in light mode.
The getDllAddr function retrieves a process-loaded DLL based on the PEB.
The getFunctionFromDll function parses the Export Address Table (EAT) to retrieve a function from a DLL.
The copyHeaders function copies the headers from the unloaded DLL to a previously allocated virtual memory region.
The copySections function copies the sections from the unloaded DLL to a previously allocated virtual memory region.
The initializeIAT function parses the Import Address Table (IAT) to update function pointer addresses.
The performRelocations function resolves relocations.
A non-exhaustive list:
- Use
HRESULTfor cleaner error handling. - Manage Delay Load Imports (not that important I think).
- Manage the Exception Table the way Rhadamanthys does.
- ...
There are no evasion features in this code.