Reflective DLL Injection

• Problem for attackers: LoadLibrary needs a DLL on disk and registers the module in the loader's lists (easy to spot).
• Reflective injection: the DLL loads itself from a memory buffer.
• Injector writes the raw DLL bytes into the target.
• A bootstrap function inside the DLL manually parses its own PE headers, maps sections, resolves imports, applies relocations, and calls DllMain.
• No file on disk, no 0 call, module not in the standard module list.
• Core to Meterpreter and many post-exploitation frameworks.