The Tradecraft Garden

The Tradecraft Garden is a collection of position-independent DLL loaders with background information on each.

Download

• Source (20250604)

Technique Hikes

• Page Streaming Use guard pages and Vectored Exception Handlers to "stream" DLL pages as needed
• Stack Cutting Push sensitive Win32 API calls through a stack-cutting call proxy.

Learning Path

• Reflective DLL Injection Stephen Fewer's ReflectiveDLLInjection with minimal changes
• Simple Loader 1 Simple DLL loader
• Simple Loader 2 (COFF) Simple DLL loader that frees itself with an embedded COFF
• Simple Loader 3 (Resource Masking) Simple DLL loader that accesses masked resources
• Simple Loader 4 (Pointer Patching) Simple DLL loader that bootstraps with patched-in pointers
• Simple Loader 5 (Execution Guardrails) Simple DLL loader that implements execution guardrails
• Simple Loader 6 (Hooking) Simple DLL loader that uses IAT hooks to change loaded DLL's behavior