Windows Dynamic-Link Library research & offensive tooling.
- Introduction to Module Stomping
- Advanced Evasion Tradecraft: Precision Module Stomping
- Hunting for Module Stomping Targets
- Don’t Be So Primitive: Evolving the Module Stomping Staging Chain
Passively monitoring active APIs.
-
Frida Dynamic API Monitoring Telemetry Agent (
api-monitor.py): A dynamic instrumentation tool that injects a runtime JavaScript payload into target processes to automatically hook and track exported functions. It leverages asynchronous retry loops for deferred modules and filters out duplicate calls to stream clean, structured API telemetry directly to a JSONL log. -
PE Dormant Export Analyzer (
find-dormant-blocks.py): A static analysis tool that parses a DLL's export table and SEH exception directories (.pdata) to map function boundaries linearly in memory. It cross-references these mappings against runtime telemetry and custom blacklists to identify contiguous, unused code blocks that meet specified capacity thresholds.
-
hellow-dll.cis a minimalistic Dynamic Link Library (DLL) template designed to verify basic DLL loading dynamics and export triggering. Unlike more complex implementations that decouple execution via background threads, this component serves as a direct, synchronized test payload to confirm immediate entry-point execution and explicit export accessibility. -
notabeacon.cis a benign, non-malicious C-based DLL designed to mimic the execution flow and timing footprints typically associated with command-and-control (C2) agents or beacons. It serves as a safe testing utility for verifying detection pipelines, telemetry collection, and binary side-loading or manual mapping techniques without introducing actual risk to the environment.
-
Stability Campaign Plan Generator (
make-stability-plan.py): A data transformation utility that converts raw CSV binary audit sheets into structured JSON execution plans. It adaptively shifts between granular function-level testing arguments or broad full-module section overwrites based on available metadata. -
Process Stability Campaign Harness (
stability-harness.py): An automated testing orchestration engine designed to execute and monitor the generated parametric process stability profiles. It launches target binaries, tracks the lazy loading of associated DLL runtime dependencies, integrates concurrent module-stomping companion tools, and captures kernel exit codes into structured JSONL logging manifests.
Compiled process profiles for common applications and Operating Systems. YMMY.