A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace.

Setup

Havoc:

Clone my fork that support User-Defined Reflective Loader.

git clone https://github.com/0xPrimo/Havoc.git
cd Havoc

Follow the installation docs.

User-Defined Reflective Loader:

  1. Install Crystal Palace linker by following the installation docs.
  2. Start Crystal Palace server:
cpl server
  1. Clone repo
git clone https://github.com/0xPrimo/DemonLdr.git
cd DemonLdr
  1. Build
# debug
make x64-debug

# release
make x64
  1. Load DemonLdr.py

Hooks

Hook loader imports:

Edit loader.spec :

x64:
    ...
    attach "MODULE$FUNC" "_MyHook"
    ...

Edit hooks.c:

...
BOOL _MyHook() {
    LOG_INFO("_MyHook called");
    return MODULE$FUNC();
}
...

Hook demon imports:

Edit pico.spec:

x64:
    ...
    addhook "MODULE$FUNC" "_MyHook"
    ...

Edit hooks.c:

...
BOOL _MyHook() {
    LOG_INFO("_MyHook called");
    return MODULE$FUNC();
}
...

Credits: