bats3c/DarkLoadLibrary

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1188 stars · 203 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DarkLoadLibrary is a C library implementing an alternative to the Windows LoadLibrary API designed for offensive security operations. It loads DLLs from disk or memory while avoiding image load kernel callbacks and optionally bypassing PEB module linking to evade detection.

Use cases

• load a DLL from memory without triggering image load kernel callbacks
• load a DLL without linking it to the PEB module list
• evade EDR detection of module loading during red team operations
• implement stealthy reflective DLL loading in C
• load a local DLL bypassing the standard Windows loader telemetry

When to choose

• you are writing offensive tooling or red team implants on Windows that need stealthy DLL loading
• you need to bypass image load kernel callback telemetry
• you want memory-based DLL loading with control over PEB registration

When to avoid

• you need a general-purpose, fully compatible DLL loader for legitimate applications
• you need a maintained, licensed library for production software
• you are not comfortable with low-level Windows internals in C

Facets

library · maturity maintenance

security reverse-engineering security penetration-testing windows windows cpp dll-loading red-team offensive-security kernel-callback-bypass peb-unlinking malware-development

Member repositories

For agents

markdown · JSON · MCP: product_card(name="bats3c/DarkLoadLibrary")