DllShimmer facilitates DLL hijacking, enabling users to inject code into target DLLs without altering their original functionality. It works by analyzing an original DLL and generating a proxy DLL that forwards function calls to the original. The core problem it addresses is the need for a stealthy and non-invasive means of code injection, bypassing traditional hooking mechanisms. It primarily utilizes Go for its efficiency and cross-platform capabilities.
DllShimmer distinguishes itself through its simple approach to DLL hijacking, requiring no reverse engineering or function signature analysis. It generates a proxy DLL with a completely new and suspicious Export Address Table (EAT), making it harder to detect. The tool offers both dynamic and static linking options, providing flexibility in various attack scenarios. It also offers a mutex to limit execution frequency.
- Function Proxying: Enables injection of code into functions exported from target DLLs.
- Dynamic/Static Linking: Supports both dynamic and static linking with flexible configuration.
- Mutex Protection: Prevents multiple executions of the backdoor within a single process.
- Cross-Platform: Designed to work on x86-64 / AMD64 architecture.
- Debug Logging: Provides an option to save detailed debug logs for analysis.
- Simple Configuration: Offers command-line arguments for easy customization.
- Export Definition File: Generates a '.def' file ensuring consistent export names and ordinal values.
DllShimmer is an active project with recent commits and community engagement. While documentation is comprehensive, the project is still under development, with planned enhancements like support for C++ mangled function names. The use of mutex protection and debug logging shows a focus on reliability and usability. Documentation addresses common issues and provides troubleshooting steps.
DllShimmer benefits security researchers, penetration testers, and red teams seeking to establish persistence or perform advanced attacks. It allows bypassing standard detection methods by leveraging DLL hijacking, which provides a lower-profile approach than direct code injection. It offers an alternative to more complex or signature-based malware techniques, requiring minimal reverse engineering of the target.