The Tradecraft Garden

The Tradecraft Garden is a collection of position-independent capability loaders with background information on each.

Download

• Source (20260601)

Technique Hikes

• COFF Mixing Mix capability code with other object code in PE-ready COFF output
• Module Stomping Load a PICO's code, data, and unwind contents over a module
• Page Streaming Use guard pages and Vectored Exception Handlers to "stream" DLL pages as needed
• Stack Cutting Push sensitive Win32 API calls through a stack-cutting call proxy.

Common Ground

• Tradecraft Garden Library DLL loading, PICO running, and printf debugging for PIC and PICOs

Learning Path

• Reflective DLL Injection Stephen Fewer's ReflectiveDLLInjection with minimal changes
• Simple Loader Simple DLL loader
• Simple Loader (COFF) Simple DLL loader that frees itself with an embedded COFF
• Simple Loader (Resource Masking) Simple DLL loader that accesses masked resources
• Simple Loader (Pointer Patching) Simple DLL loader that bootstraps with patched-in pointers
• Simple Loader (Execution Guardrails) Simple loader stage that implements execution guardrails
• Simple Loader (Hooking) Simple DLL loader that uses IAT hooks to change loaded DLL's behavior
• Simple Loader (COFF Capability) Simple OBJ loader
• Simple Loader (COFF or DLL) Simple OBJ and DLL loader (supporting both)
• Simple (Unwinding) Loader Simple OBJ loader that generates and registers x64 unwind data
• Simple PIC Simple PIC Services Module
• Simple BOF Simple BOF Runner