adroxz1122/injected-host-enumeration

This is a Windows security research project, described in the README as for educational purposes only, that demonstrates how DLL injection works in practice. The code walks through a chain of techniques studied in offensive security courses: encrypting a payload DLL, encoding it as UUID strings inside an executable's resource section, and then decrypting and injecting it into a running process at runtime. The project has three stages. First, a DLL payload is compiled, and tools in the repository encrypt it with the RC4 cipher and convert the encrypted binary into a list of UUID-formatted strings that look like ordinary identifier values to a scanner. Second, those UUID strings are embedded inside the loader executable using a Windows resource script, so the final program carries everything it needs with no separate DLL file on disk. Third, when the loader runs, it reads the embedded resource, parses the UUID strings back into bytes, decrypts the DLL, writes it to a temporary file in the Windows TEMP directory, injects it into a target process (the default is Notepad), and then deletes the temporary file. The injection itself uses standard Windows API calls: the loader opens the target process, allocates memory inside it, writes a DLL path, and starts a thread in the remote process that calls LoadLibraryW, telling the operating system to load the DLL. The UUID encoding and RC4 encryption layer is there to prevent static signature-based scanners from recognizing the DLL by its raw bytes. The README includes a list of planned changes the author intends to make: loading the DLL directly into memory without writing to disk, replacing RC4 with AES encryption, and adding a network connection to send results to a remote server rather than writing to a local file. Building requires MinGW-w64 or MSVC, the standard Windows SDK headers, and a four-step compile sequence described in the README. The project must be used only on systems the user owns or has explicit permission to test.