28zaaky/shdwldr

ShadowLdr is a reflective DLL loader for 64-bit Windows. A DLL is a package of code that programs load at runtime. Normally, Windows handles this loading step automatically through its built-in loader. ShadowLdr skips that built-in loader and maps a DLL directly from memory instead. This matters for security tools and offensive security work, where avoiding the normal loading process helps evade detection. The project is written in C and built for the x64 architecture only. The loader uses several techniques to stay stealthy. It resolves Windows API functions using hash-based lookups instead of storing readable function names, which avoids leaving plaintext strings in the binary. It uses direct system calls through a combination of approaches called Hell's Gate, Halos Gate, and Tartarus Gate, including logic to recover from hooked system call stubs. It sets memory permissions per section, runs thread-local storage callbacks and slot allocation before the DLL's main entry point, and registers exception handling tables for x64 structured exception handling. It also includes bypasses for AMSI and ETW, two Windows security monitoring features, and erases the DLL header after loading. Building the project requires a cross-compilation toolchain targeting Windows from a Linux environment. The README provides compiler commands using the MinGW-w64 toolchain. A specific file alignment flag is required so that the DLL can run from a raw memory buffer using RIP-relative addressing. The usage example shows allocating executable memory, copying a raw DLL into it, and calling an exported reflective loader function to map and initialize it. The README notes some limitations. It works only on x64 and does not add an entry to the loaded module list, which is intentional for stealth. Module stomping is disabled because certain Windows behavior on version 10 and later would trigger the DLL entry point prematurely. A debug export contains runtime telemetry like system service numbers and allocation methods, and should be removed for production use. The full README is longer than what was shown.