> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/code-injection-process-injection/reflective-shellcode-dll-injection.md).

# Shellcode Reflective DLL Injection

Shellcode reflective DLL injection (sRDI) is a technique that allows converting a given DLL into a position independent shellcode that can then be injected using your favourite shellcode injection and execution technique. In this lab I wanted to try this technique as I think it is an amazing technique to have in your arsenal.

In this lab, I'm playing with the amazing <https://github.com/monoxgas/sRDI> written by monoxgas from Silent Break Security.

## Execution

Let's compile a simple x86 DLL - in my case, an odd DLL that pops 2 notepad processes when executed:

![](/files/-LjSvUBjVqzB_3nceoWi)

Convert the DLL into shellcode. We will get an array of shellcode bytes represented in decimal values:

```csharp
$sc = ConvertTo-Shellcode \\VBOXSVR\Experiments\messagebox\messagebox\Debug\messagebox.dll
```

![](/files/-LjScZ1IsecIta-eRGP9)

Let's convert them to hex:

```csharp
$sc2 = $sc | % { write-output ([System.String]::Format('{0:X2}', $_)) }
```

![](/files/-LjSdspQB8-dVUn0PySt)

Join them all and print to a text file:

```
$sc2 -join "" > shell.txt
```

![](/files/-LjSpDUX4et_bGhXqEjU)

Create a new binary file with the shellcode we got earlier - just copy the hex string (as seen in the above screenshot) and paste it to a new file using HxD hex editor:

![](/files/-LjSw2nFPXwgHVVMttmd)

In order to load and execute the shellcode, we will place it in the binary as a resource as described in my other lab [Loading and Executing Shellcode From PE Resources](/offensive-security/code-injection-process-injection/loading-and-executing-shellcode-from-portable-executable-resources.md):

![](/files/-LjSw86-sEyrM6zkGbz3)

Compile and run the binary. If the shellcode runs successfully, we should see two notepad.exe processes popup:

![](/files/-LjSwX8r33rMWYenuqnq)

## References

{% embed url="<https://github.com/monoxgas/sRDI/tree/master/PowerShell>" %}