sRDI is a compact project that implements a shellcode form of Reflective DLL Injection, enabling DLLs to be converted into position-independent shellcode and loaded in memory by a small in-process PE loader. The codebase groups a C implementation of a reflective PE loader with multiple loader/wrapper components (native C loader, a .NET loader, Python and PowerShell conversion helpers) so authors can produce and embed sRDI blobs in different environments. The loader aims to behave like a proper PE loader: it preserves section permissions, supports TLS callbacks, performs sanity checks, and exposes flags to control behaviors such as header clearing, memory wiping, import obfuscation, and whether the shellcode receives the base address. The repository also provides utility scripts to convert DLL binaries into embedded blobs and to update static encodings used by the supplied loaders.
Features
- Sandboxed conversion mode that validates and analyzes a DLL before producing a shellcode blob
- Built-in architecture detection and multi-arch shellcode output (x86, x64, ARM)
- Optional safe execution mode that simulates loading without executing module code
- Pluggable encoders to produce obfuscated or encoded blobs with selectable strategies
- High-level API for embedding encoded blobs into projects or resource sections
- Integration tests and CI that run non-destructive loader sanity checks on example DLLs
Project Samples
