h4vox/dynloader

Dynloader is a Windows research tool written in C++ that loads and runs small programs called shellcode. It is built for security researchers studying how software payloads are delivered and executed on Windows systems. The author is clear that it is for educational purposes only and should not be used on systems you do not own or have permission to test. The tool can load shellcode from a local file on disk, or fetch it over the internet without saving it to the hard drive. It supports encrypting payloads with AES-256-CBC so the shellcode stays scrambled until the moment it runs. You can run shellcode directly in the loader's own process, or inject it into another running program by targeting its process name or numeric process ID. If the target program is not running, Dynloader can start it in a hidden, suspended state, inject the shellcode, and then resume it. Most of the technical work is handled by a companion library called Dynveil, which sits in the lib folder. Dynveil provides the building blocks: parsing Windows internal structures, resolving Windows functions by hash instead of by name, setting up indirect system calls through a technique called Tartarus Gate, mapping memory sections, handling AES encryption and decryption, and running a minimal HTTP server and client for fileless delivery. Dynloader itself is the command line layer that orchestrates these pieces. The README includes a detailed breakdown of evasion techniques the tool uses, such as avoiding readable function names in the compiled binary, never marking memory as both writable and executable at the same time, and routing Windows system calls through specific code gadgets to bypass monitoring software. These choices are designed to make the tool harder for endpoint detection and response software to catch. Building requires Windows 10 or 11 with Microsoft's C++ compiler. A build script can install the compiler if it is missing. Usage examples show local runs, fileless runs fetching from a server, and running the built in HTTP server. The README also covers a self test mode that checks core functions like memory resolution and encryption.