Skip to content
Reverse Engineering
Code Injectionadvanced

Reflective DLL Injection

Loading a DLL straight from memory by implementing the Windows loader inside the payload itself, so no DLL is ever written to disk or registered in the process module list.

Reflective DLL injection ships a DLL as a raw buffer plus a small bootstrap function (ReflectiveLoader) that performs the work the Windows loader normally does — so the DLL is mapped and run entirely from memory, never touching disk and never appearing in the PEB module list.

What the loader stub does

  1. Walk the PEB to resolve kernel32 exports it needs (LoadLibraryA, GetProcAddress, VirtualAlloc).
  2. Allocate memory and copy the DLL's headers and sections into place.
  3. Process the base relocations and resolve the import address table.
  4. Call the DLL's entry point (DllMain) with DLL_PROCESS_ATTACH.
text
WriteProcessMemory(hProc, buf, dllBytes, len)
CreateRemoteThread(hProc, NULL, 0, buf + offsetof(ReflectiveLoader), ...)

Detection & analysis

  • There is no module entry for the DLL — enumerate executable private memory instead (pe-sieve, Moneta, Volatility's malfind).
  • Look for CreateRemoteThread / thread start addresses pointing into MEM_PRIVATE RWX regions with a PE header but no backing file.
  • Dump the region and rebuild headers to analyze the hidden DLL offline.
Votes

Comments(0)