Change RDI so that the loader function can be specified by name or ordinal

[OJ]

With the goal of removing more and more recognisable stuff from the DLLs, I've modified the code to allow the user to specify the name or ordinal of the ReflectiveLoader.

This means that:

1. The loader can be exported via a DEF using a different name or ordinal
2. The loader can still load that custom DLL
3. We can remove all evidence of ReflectiveLoader from the DLL images we produce, and load functions based on ordinals

Clearly this breaks back compat, so it might need to be rolled into all the other things that we've done.

This relates to:

• Meterpreter PR
• Metasploit PR

[OJ]

This is exactly what the rest of the RDI code had done for years when testing for ordinals. I just ported it to this over to this function because it was the one point it hadn't been implemented!

…

On Sat, 20 Jun 2020, 07:59 Spencer McIntyre, ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In inject/src/LoadLibraryR.c <#9 (comment)> : > + // test if we are importing by name or by ordinal... + if (((DWORD)cpReflectiveLoaderName & 0xFFFF0000) == 0x00000000) This sort of looks a little fragile, especially for 64-bit systems. Would it be possible to make the interpretation of ordinal vs name more explicit? If not at least comparing a QWORD value with 0xffffffffffff0000 on 64-bit systems would help reduce the risk of a misinterpretation. I know it has to be passed around so ByOrdinal and ByName suffixes would probably be a pain to write, but what about using a struct? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#9 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAHBYBKXA7LBXF3GBHTUHDRXPNSTANCNFSM4ND5GZHQ> .

[OJ]

As discussed on Slack @smcintyre-r7 @bcook-r7 👍 Thanks!

[smcintyre-r7]

I tested this with the corresponding metasploit-payloads PR. The payloads are loading and it looks like the functionality that this introduces is solid and working as intended. I'll have this merged momentarily before moving on to some more indepth testing on the payloads side of things. Thanks @OJ !

[OJ]

Thank you!