Reflective DLL Injection Theory
LoadLibrary performs a series of actions including loading DLL files from disk
and setting the correct memory permissions.
It also registers the DLL so it becomes usable from APIs like GetProcAddress
and is visible to tools like Process Explorer.
Since we do not need to rely on
GetProcAddress and want to avoid detection,
we are only interested in the memory mapping of the DLL.
Reflective DLL injection
parses the relevant fields of the DLL’s Portable Executable file format
and maps the contents into memory.
In order to implement reflective DLL injection,
we could write custom code
to essentially recreate and improve upon the functionality of LoadLibrary.
Since the inner workings of the code
and the details of the PE file format are beyond the scope of this module,
we’ll instead reuse existing code to execute these techniques.
The ultimate goal of this technique
is to maintain the essential functionality of LoadLibrary
while avoiding the write to disk
and avoiding detection by tools such as Process Explorer.