# bats3c/DarkLoadLibrary

LoadLibrary for offensive operations

Repository: https://github.com/bats3c/DarkLoadLibrary
Canonical: https://ross.abutalabs.com/products/darkloadlibrary
Homepage: https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/
Language: C
License Family: other
Last push: 2021-10-22T07:27:58+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 1903, "days_push": 1776, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1188, forks 203 (observed 2026-08-28T04:03:55.362829+00:00)

## What it is
DarkLoadLibrary is a C library implementing an alternative to the Windows LoadLibrary API designed for offensive security operations. It loads DLLs from disk or memory while avoiding image load kernel callbacks and optionally bypassing PEB module linking to evade detection.

## Use cases
- load a DLL from memory without triggering image load kernel callbacks
- load a DLL without linking it to the PEB module list
- evade EDR detection of module loading during red team operations
- implement stealthy reflective DLL loading in C
- load a local DLL bypassing the standard Windows loader telemetry

## When to choose
- you are writing offensive tooling or red team implants on Windows that need stealthy DLL loading
- you need to bypass image load kernel callback telemetry
- you want memory-based DLL loading with control over PEB registration

## When to avoid
- you need a general-purpose, fully compatible DLL loader for legitimate applications
- you need a maintained, licensed library for production software
- you are not comfortable with low-level Windows internals in C

## Facets
- artifact type: library
- maturity: maintenance
- function: security, reverse-engineering
- domain: security, penetration-testing, windows
- platform: windows, cpp
- tags: dll-loading, red-team, offensive-security, kernel-callback-bypass, peb-unlinking, malware-development

## Member repositories
- bats3c/DarkLoadLibrary (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:55.362829+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:23:23.590552+00:00, confidence not recorded.
  - readme: https://github.com/bats3c/DarkLoadLibrary (fetched 2026-08-28T04:03:55.362829+00:00, sha aea30352baba)
  - homepage: https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ (fetched 2026-08-29T12:30:31.362085+00:00, sha 2d5596143700)
- Data as of 2026-08-30T08:39:29.467469+00:00.