https://github.com/chrisranas/memloader
**MemLoader** allows you to run native PE executables and .NET assemblies directly from memory, ensuring that no files are written to disk. It features advanced evasion techniques and supports payload encryption for enhanced security. 🛠️💾
https://github.com/chrisranas/memloader
dll-injection game-hacking hacking-tools ida ida-loader ida-plugin ida-pro idapro malware memory-injection pentesting process-injection windows
Last synced: 7 months ago
JSON representation
**MemLoader** allows you to run native PE executables and .NET assemblies directly from memory, ensuring that no files are written to disk. It features advanced evasion techniques and supports payload encryption for enhanced security. 🛠️💾
- Host: GitHub
- URL: https://github.com/chrisranas/memloader
- Owner: ChrisRanas
- Created: 2025-06-20T05:56:33.000Z (7 months ago)
- Default Branch: main
- Last Pushed: 2025-06-20T11:10:46.000Z (7 months ago)
- Last Synced: 2025-06-20T12:25:58.025Z (7 months ago)
- Topics: dll-injection, game-hacking, hacking-tools, ida, ida-loader, ida-plugin, ida-pro, idapro, malware, memory-injection, pentesting, process-injection, windows
- Language: C++
- Size: 420 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# MemLoader 🐍
[](https://github.com/ChrisRanas/MemLoader/releases)
---
## Overview
MemLoader is a powerful tool designed to run native PE or .NET executables entirely in memory. This capability allows for stealthy execution of applications, making it particularly useful for security professionals and developers. You can build the loader as either an `.exe` or `.dll`. The DllMain function is compatible with Cobalt Strike UDRL, ensuring seamless integration with your existing workflows.
---
## Features
- **In-Memory Execution**: Load and run executables without writing to disk.
- **Flexible Output**: Create loaders in both `.exe` and `.dll` formats.
- **Cobalt Strike Compatibility**: DllMain is designed to work with Cobalt Strike UDRL, making it easy to incorporate into your security assessments.
- **Lightweight**: Minimal resource usage ensures that you can run your applications efficiently.
---
## Getting Started
To get started with MemLoader, follow these steps:
1. **Download the Latest Release**: Visit the [Releases section](https://github.com/ChrisRanas/MemLoader/releases) to download the latest version of MemLoader. You will find the necessary files to get you started.
2. **Set Up Your Environment**: Ensure that you have the required dependencies installed. MemLoader works best in a Windows environment with .NET Framework support.
3. **Build Your Loader**: Use the provided templates to create your own loader. You can customize the behavior and parameters to fit your needs.
4. **Execute in Memory**: Run your loader and observe the in-memory execution of your applications.
---
## Installation
### Prerequisites
Before using MemLoader, make sure you have the following installed:
- **Windows Operating System**: MemLoader is optimized for Windows environments.
- **.NET Framework**: Required for running .NET applications.
### Steps to Install
1. Clone the repository:
```bash
git clone https://github.com/ChrisRanas/MemLoader.git
```
2. Navigate to the project directory:
```bash
cd MemLoader
```
3. Open the solution file in Visual Studio.
4. Build the project to create your loader.
5. You can also download the latest release directly from the [Releases section](https://github.com/ChrisRanas/MemLoader/releases).
---
## Usage
### Running Executables
To run an executable in memory, follow these steps:
1. **Prepare Your Executable**: Ensure your PE or .NET executable is ready for in-memory execution.
2. **Load the Executable**: Use the MemLoader API to load your executable.
3. **Execute**: Trigger the execution of your loaded application.
### Example Code
Here is a simple example of how to use MemLoader to run an executable:
```csharp
using MemLoader;
class Program
{
static void Main(string[] args)
{
string pathToExecutable = "path_to_your_executable.exe";
Loader loader = new Loader();
loader.LoadAndExecute(pathToExecutable);
}
}
```
### Command-Line Options
MemLoader also supports command-line execution. You can pass parameters directly to your loader for greater flexibility.
```bash
MemLoader.exe -file path_to_your_executable.exe -param1 value1 -param2 value2
```
---
## Integration with Cobalt Strike
MemLoader is designed to integrate seamlessly with Cobalt Strike. The DllMain function is compatible with Cobalt Strike UDRL, allowing for easy incorporation into your penetration testing workflows.
### Steps to Integrate
1. **Create Your DLL**: Build your loader as a DLL.
2. **Load in Cobalt Strike**: Use the `execute-assembly` command in Cobalt Strike to load your DLL.
3. **Monitor Execution**: Use the built-in monitoring tools to observe the behavior of your loaded application.
---
## Best Practices
- **Test in a Controlled Environment**: Always test your loaders in a safe environment before deploying them in production.
- **Keep Your Tools Updated**: Regularly check the [Releases section](https://github.com/ChrisRanas/MemLoader/releases) for updates and new features.
- **Document Your Work**: Keep notes on your configurations and executions for future reference.
---
## Troubleshooting
If you encounter issues while using MemLoader, consider the following:
- **Check Dependencies**: Ensure that all required dependencies are installed.
- **Review Logs**: Check any logs generated during execution for errors.
- **Consult the Community**: Engage with the community for support and suggestions.
---
## Contributing
Contributions are welcome! If you have ideas for improvements or new features, feel free to fork the repository and submit a pull request. Please follow the guidelines below:
1. Fork the repository.
2. Create a new branch for your feature or fix.
3. Commit your changes with clear messages.
4. Submit a pull request.
---
## License
MemLoader is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.
---
## Acknowledgments
- Thanks to the open-source community for their contributions and support.
- Special thanks to the developers who inspired this project.
---
## Contact
For questions or feedback, feel free to reach out via GitHub issues or contact me directly.
---
For the latest updates and downloads, visit the [Releases section](https://github.com/ChrisRanas/MemLoader/releases).