Shellcode Injection
DioProcess provides 3 shellcode injection methods for executing raw machine code in remote processes.
Dangerous Operation
Shellcode injection can execute arbitrary code in remote processes. Only use on systems you own or have explicit permission to test.
Available Methods
1. Classic
File-basedRead raw shellcode from a .bin file and inject using the standard technique.
Algorithm:
OpenProcesswith PROCESS_ALL_ACCESSVirtualAllocEx(PAGE_READWRITE)— allocate RW memoryWriteProcessMemory— write shellcode bytesVirtualProtectEx(PAGE_EXECUTE_READWRITE)— make executableCreateRemoteThreadat shellcode address
File:
Functions:
classic.rsFunctions:
inject_shellcode_classic(), inject_shellcode_bytes()2. Web Staging
URL DownloadDownload shellcode from a URL via WinInet, then inject using the classic technique. Useful for staged payloads.
Algorithm:
InternetOpenW— initialize WinInetInternetOpenUrlW— open HTTP/HTTPS URLInternetReadFile— read in 1024-byte chunks- Inject using classic technique
File:
Function:
web_staging.rsFunction:
inject_shellcode_url()3. Threadless
AdvancedNo CreateRemoteThread. Hooks an exported function with a CALL trampoline. Payload fires when the target process naturally calls the hooked function.
Algorithm:
- Find target function (e.g.,
USER32!MessageBoxW) - Allocate "memory hole" within ±1.75 GB of target function
- Write 63-byte hook stub (saves registers, restores original bytes, calls payload, jumps back)
- Write main shellcode payload after stub
- Patch target function with 5-byte CALL trampoline
- Self-healing: hook restores original bytes after first execution
File:
Function:
threadless.rsFunction:
inject_shellcode_threadless()Default Target
Default hook target is
USER32!MessageBoxW. This can be customized in the UI to any exported function.Usage
Access shellcode injection via the UI:
- Right-click on a process in the Process tab
- Navigate to Miscellaneous → Shellcode Injection
- Select the injection method:
- • Classic — file picker for
.binshellcode files - • Web Staging — opens modal with URL input field
- • Threadless — opens modal with shellcode file picker + target DLL/function inputs
- • Classic — file picker for
Method Comparison
| Method | New Thread | Network | Execution |
|---|---|---|---|
| Classic | Yes | No | Immediate |
| Web Staging | Yes | Yes | Immediate |
| Threadless | No | No | On function call |