Reflective Loader for extensions in metsrv by msutovsky-r7 · Pull Request #797 · rapid7/metasploit-payloads

msutovsky-r7 · 2026-03-23T09:38:27Z

Fixes this issue
This PR ~~is a first draft for~~ adds custom extension reflective loader in Metsrv. The reflective loader is similar to the reflective loader already used, however, it does not search for start of PE file - it rather accepts pointer to DLL as argument.

test extension loading for x64
test extension loading for x86

Copilot

Pull request overview

Adds a custom “manual-map” style reflective loader to metsrv so in-memory extension DLLs can be loaded directly from a buffer pointer (without scanning for the PE header), addressing the linked extension-loading issue.

Changes:

Introduces extension_loader.c/.h implementing PE mapping (sections, relocations, imports, permissions) and invoking the DLL entry point.
Updates request_core_loadlib to use LoadReflectively() for non-disk extension loading (with fallback to libloader_load_library()).
Updates the Visual Studio project files to compile and include the new loader sources.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 13 comments.

File	Description
c/meterpreter/workspace/metsrv/metsrv.vcxproj.filters	Adds the new loader files to the VS filters.
c/meterpreter/workspace/metsrv/metsrv.vcxproj	Adds the new loader files to the VS build.
c/meterpreter/source/metsrv/remote_dispatch.c	Switches in-memory extension loading to the new loader and adds related logging/formatting changes.
c/meterpreter/source/metsrv/extension_loader.c / .h	New implementation of the custom reflective loader.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-26T13:28:10Z

+	// 3. Fix relocations
+	dprintf("[LOADREFLECTIVELY] Fixing relocations\n");
+	if(!FixRelocations(pRelocationTableDirectory, (ULONG_PTR)pDLLBaseAddress, pNtHeaders->OptionalHeader.ImageBase))
+	{
+		dprintf("[LOADREFLECTIVELY] Failed to fix relocations\n");
+		return FALSE;
+	}


On failure after VirtualAlloc, LoadReflectively returns without freeing pDLLBaseAddress, leaking memory (e.g. when FixRelocations/FixIAT/FixPermissions/DllMain fails). Ensure all error paths release the allocated image (and consider resetting *phModule consistently).

Copilot is right here, we have as a standard flow to use:

do { BREAK_WITH_ERROR... }while(0);

where we use a do-while block as try-catch. it's ugly but it works... check on poolparty.c to see how is done.

Copilot · 2026-03-26T13:28:11Z

+
+

Two extra blank lines were added here, creating unnecessary vertical whitespace. Please remove the redundant blank lines to keep formatting consistent in this file.

Suggested change

Copilot · 2026-03-26T13:28:12Z

+BOOL FixRelocations(PIMAGE_DATA_DIRECTORY dRelocBaseAddress, ULONG_PTR pBaseAddress, ULONG_PTR pPreferrableAddress)
+{
+	ULONG_PTR delta = pBaseAddress - pPreferrableAddress;
+	PIMAGE_BASE_RELOCATION pBaseRelocationTable = (PIMAGE_BASE_RELOCATION)(pBaseAddress + dRelocBaseAddress->VirtualAddress);


FixRelocations computes delta as an unsigned ULONG_PTR. If the allocated base is lower than the preferred image base, this underflows and relocations will be applied incorrectly. Use a signed type (e.g. LONG_PTR/intptr_t) for the delta and apply it accordingly for 32-bit/64-bit relocation types.

I am not too sure about it, i will investigate

original implementation uses ULONG_PTR I would lean tword leave it as it is if nothing is exploding

Alright, sounds good to me

Copilot · 2026-03-26T13:28:13Z

+
+		dprintf("[FIXPERM] Setting permissions for section %p to %x with size %x\n",pBaseAddress + pSectionHeader[i].VirtualAddress , dwProtection, pSectionHeader[i].SizeOfRawData);
+		LPVOID lpAddress = (PBYTE)pBaseAddress + pSectionHeader[i].VirtualAddress;
+		if(met_api->win_api.kernel32.VirtualProtect(&(lpAddress), pSectionHeader[i].SizeOfRawData, dwProtection, &dwOldFlags) == 0)


VirtualProtect is called with &(lpAddress) (a pointer-to-pointer) instead of the section base address. This will attempt to change protections on the stack variable rather than the mapped image. Pass lpAddress directly.

Suggested change

if(met_api->win_api.kernel32.VirtualProtect(&(lpAddress), pSectionHeader[i].SizeOfRawData, dwProtection, &dwOldFlags) == 0)

if(met_api->win_api.kernel32.VirtualProtect(lpAddress, pSectionHeader[i].SizeOfRawData, dwProtection, &dwOldFlags) == 0)

@msutovsky-r7 I think this is a good catch from Copilot.

Copilot · 2026-03-26T13:28:13Z

+#include "common.h"
+
+typedef struct _BASE_RELOCATION_ENTRY {
+	WORD	Offset : 12;  // Specifies where the base relocation is to be applied.
+	WORD	Type : 4;   // Indicates the type of base relocation to be applied.
+} BASE_RELOCATION_ENTRY, * PBASE_RELOCATION_ENTRY;
+
+BOOL LoadReflectively(IN ULONG_PTR lpBuffer, OUT HMODULE* phModule);


extension_loader.h is missing an include guard (or #pragma once). All other metsrv headers appear to use #ifndef/#define/#endif guards (e.g. libloader.h), so this risks accidental double-inclusion and breaks the established header pattern.

Copilot · 2026-03-26T13:28:13Z

+	PIMAGE_BASE_RELOCATION pBaseRelocationTable = (PIMAGE_BASE_RELOCATION)(pBaseAddress + dRelocBaseAddress->VirtualAddress);
+	PBASE_RELOCATION_ENTRY pBaseRelocEntry = NULL;
+
+	while (pBaseRelocationTable->SizeOfBlock != 0)


FixRelocations walks the relocation blocks until it sees a SizeOfBlock == 0, but it never validates dRelocBaseAddress->VirtualAddress/Size nor enforces an upper bound. If the image has no relocation directory (common when stripped) or the directory is malformed, this will read/patch out of bounds. Guard on dRelocBaseAddress->Size != 0 and stop after processing Size bytes.

Suggested change

PIMAGE_BASE_RELOCATION pBaseRelocationTable = (PIMAGE_BASE_RELOCATION)(pBaseAddress + dRelocBaseAddress->VirtualAddress);

PBASE_RELOCATION_ENTRY pBaseRelocEntry = NULL;

while (pBaseRelocationTable->SizeOfBlock != 0)

// Validate relocation directory before using it. If there is no relocation

// directory (common for stripped images) or it is malformed, treat this as

// "no relocations to apply" instead of walking arbitrary memory.

if (dRelocBaseAddress == NULL ||

dRelocBaseAddress->Size == 0 ||

dRelocBaseAddress->VirtualAddress == 0)

{

return TRUE;

}

PIMAGE_BASE_RELOCATION pBaseRelocationTable = (PIMAGE_BASE_RELOCATION)(pBaseAddress + dRelocBaseAddress->VirtualAddress);

PBASE_RELOCATION_ENTRY pBaseRelocEntry = NULL;

PBYTE relocDirStart = (PBYTE)pBaseRelocationTable;

PBYTE relocDirEnd = relocDirStart + dRelocBaseAddress->Size;

// Walk relocation blocks but never past the bounds of the relocation directory.

while ((PBYTE)pBaseRelocationTable < relocDirEnd &&

pBaseRelocationTable->SizeOfBlock != 0 &&

(PBYTE)pBaseRelocationTable + pBaseRelocationTable->SizeOfBlock <= relocDirEnd)

Copilot · 2026-03-26T13:28:13Z

+			#if defined(_M_ARM)
+			case IMAGE_REL_BASED_ARM_MOV32T:
+				DWORD dwInstruction = *(DWORD *)((ULONG_PTR)pBaseAddress + pBaseRelocationTable->VirtualAddress + pBaseRelocEntry->Offset + sizeof(DWORD));
+				// Flip the words to get the instruction as expected (account for endianness/instruction packing).
+				dwInstruction = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
+				if ((dwInstruction & ARM_MOV_MASK) == ARM_MOVT)
+				{
+					// Pull out the encoded 16-bit immediate value (high portion of the address-to-relocate).
+					WORD wImm = (WORD)(dwInstruction & 0x000000FF);
+					wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
+					wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
+					wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
+					// Apply the relocation delta to the target address.
+					DWORD dwAddress = ((WORD)HIWORD(uiDelta) + wImm) & 0xFFFF;
+					// Create a new instruction with the same opcode and register parameters.
+					dwInstruction &= ARM_MOV_MASK2;
+					// Patch in the relocated address, re-encoding the immediate value.
+					dwInstruction |= (DWORD)(dwAddress & 0x00FF);
+					dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
+					dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
+					dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
+					// Flip the instructions words and patch back into the code.
+					*(DWORD *)((ULONG_PTR)pBaseAddress + pBaseRelocationTable->VirtualAddress + pBaseRelocEntry->Offset + sizeof(DWORD)) = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
+				}
+			#endif


The _M_ARM relocation case references uiDelta (undefined) and uses ARM_MOV_MASK/ARM_MOV_MASK2/ARM_MOVT which are not declared in this compilation unit. Even though metsrv doesn't currently build for ARM, this block will not compile if an ARM target is added. Either remove this block or make it self-contained and correct (including a break after the case).

Suggested change

#if defined(_M_ARM)

case IMAGE_REL_BASED_ARM_MOV32T:

DWORD dwInstruction = *(DWORD *)((ULONG_PTR)pBaseAddress + pBaseRelocationTable->VirtualAddress + pBaseRelocEntry->Offset + sizeof(DWORD));

// Flip the words to get the instruction as expected (account for endianness/instruction packing).

dwInstruction = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));

if ((dwInstruction & ARM_MOV_MASK) == ARM_MOVT)

{

// Pull out the encoded 16-bit immediate value (high portion of the address-to-relocate).

WORD wImm = (WORD)(dwInstruction & 0x000000FF);

wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);

wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);

wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);

// Apply the relocation delta to the target address.

DWORD dwAddress = ((WORD)HIWORD(uiDelta) + wImm) & 0xFFFF;

// Create a new instruction with the same opcode and register parameters.

dwInstruction &= ARM_MOV_MASK2;

// Patch in the relocated address, re-encoding the immediate value.

dwInstruction |= (DWORD)(dwAddress & 0x00FF);

dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;

dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;

dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;

// Flip the instructions words and patch back into the code.

*(DWORD *)((ULONG_PTR)pBaseAddress + pBaseRelocationTable->VirtualAddress + pBaseRelocEntry->Offset + sizeof(DWORD)) = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));

}

#endif

Copilot · 2026-03-26T13:28:14Z

+		dprintf("[FIXPERM] Setting permissions for section %p to %x with size %x\n",pBaseAddress + pSectionHeader[i].VirtualAddress , dwProtection, pSectionHeader[i].SizeOfRawData);
+		LPVOID lpAddress = (PBYTE)pBaseAddress + pSectionHeader[i].VirtualAddress;
+		if(met_api->win_api.kernel32.VirtualProtect(&(lpAddress), pSectionHeader[i].SizeOfRawData, dwProtection, &dwOldFlags) == 0)


The size passed to VirtualProtect is pSectionHeader[i].SizeOfRawData. This can be 0 for some sections, and it can be smaller than the in-memory size (Misc.VirtualSize), causing VirtualProtect failures or leaving part of a section with incorrect protection. Use an in-memory size (typically VirtualSize, rounded up to page alignment) and skip/handle zero-sized sections safely.

… metsrv

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…tialization

…lective-loader Collab: Reflective Loader for Meterpreter Extensions

dledda-r7 · 2026-04-21T13:04:39Z

I see is failing something with LoadLibraryR... checking it

…nsions

…nction offset

…endup function

…lective-loader Reflective Loader Fixing Stuff

msutovsky-r7 marked this pull request as ready for review March 25, 2026 10:44

msutovsky-r7 changed the title ~~WIP: Reflective Loader for extensions in metsrv~~ Reflective Loader for extensions in metsrv Mar 25, 2026

adfoster-r7 requested a review from Copilot March 26, 2026 13:21

Copilot started reviewing on behalf of adfoster-r7 March 26, 2026 13:21 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

bwatters-r7 self-assigned this Mar 26, 2026

dledda-r7 self-assigned this Mar 27, 2026

msutovsky-r7 and others added 12 commits April 8, 2026 14:06

Removes calling reflective loader from DLL, adds reflective loader to…

7f13bfd

… metsrv

Removes redundant comments and lines

a3b0d27

Adds additional relocation type

93db3d6

Moves extension loader into separate file

aaf97ab

Removes breakpoint

76d02b9

Apply suggestion from @Copilot

dbd902c

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Removes reflective loader from extensions

ca8b507

Addresses some comments

2c71c73

Restores extensions

288858c

Restore reflective loader to extensions

023b111

Removes function definition

dc5ec2b

Restore common_winapi.h

f037526

msutovsky-r7 force-pushed the feat/metsrv/custom_reflective_loader branch from 2889693 to f037526 Compare April 8, 2026 12:06

dledda-r7 reviewed Apr 13, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/metsrv.h Outdated

msutovsky-r7 and others added 4 commits April 13, 2026 12:21

Fixes the arguments in metsrv.h

a5e911e

fix: update LoadReflectively function to improve error handling

c429618

refactor: comment out LoadLibraryR inclusion and adjust extension ini…

a0c32af

…tialization

Merge pull request #1 from dledda-r7/collab/feat/metsrv/extension-ref…

e61d088

…lective-loader Collab: Reflective Loader for Meterpreter Extensions

dledda-r7 added 4 commits April 22, 2026 09:03

feat: add VirtualFreeEx function to winapi

01b124d

refactor: implement meterpreter reflective loading for stageless exte…

f98473e

…nsions

feat: add TLV_TYPE_LIB_LOADER_OFFSET to represent ReflectiveLoader fu…

144ac5c

…nction offset

feat: implement LoadLibraryR in metsrv and expose it on metapi

b1d672b

dledda-r7 and others added 5 commits April 22, 2026 09:09

feat: integrate reflective loader offset into elevate_via_service_tok…

b3b8e77

…endup function

feat: support offset for inject_dll function

81439d9

Apply suggestion from @dledda-r7

ebf6982

Apply suggestion from @dledda-r7

bbaeada

Merge pull request #2 from dledda-r7/collab/feat/metsrv/extension-ref…

0c24c2d

…lective-loader Reflective Loader Fixing Stuff

	if(met_api->win_api.kernel32.VirtualProtect(&(lpAddress), pSectionHeader[i].SizeOfRawData, dwProtection, &dwOldFlags) == 0)
	if(met_api->win_api.kernel32.VirtualProtect(lpAddress, pSectionHeader[i].SizeOfRawData, dwProtection, &dwOldFlags) == 0)

-	PIMAGE_BASE_RELOCATION pBaseRelocationTable = (PIMAGE_BASE_RELOCATION)(pBaseAddress + dRelocBaseAddress->VirtualAddress);
-	PBASE_RELOCATION_ENTRY pBaseRelocEntry = NULL;
-	while (pBaseRelocationTable->SizeOfBlock != 0)
+	// Validate relocation directory before using it. If there is no relocation
+	// directory (common for stripped images) or it is malformed, treat this as
+	// "no relocations to apply" instead of walking arbitrary memory.
+	if (dRelocBaseAddress == NULL ||
+		dRelocBaseAddress->Size == 0 ||
+		dRelocBaseAddress->VirtualAddress == 0)
+	{
+		return TRUE;
+	}
+	PIMAGE_BASE_RELOCATION pBaseRelocationTable = (PIMAGE_BASE_RELOCATION)(pBaseAddress + dRelocBaseAddress->VirtualAddress);
+	PBASE_RELOCATION_ENTRY pBaseRelocEntry = NULL;
+	PBYTE relocDirStart = (PBYTE)pBaseRelocationTable;
+	PBYTE relocDirEnd = relocDirStart + dRelocBaseAddress->Size;
+	// Walk relocation blocks but never past the bounds of the relocation directory.
+	while ((PBYTE)pBaseRelocationTable < relocDirEnd &&
+		pBaseRelocationTable->SizeOfBlock != 0 &&
+		(PBYTE)pBaseRelocationTable + pBaseRelocationTable->SizeOfBlock <= relocDirEnd)

Uh oh!

Conversation

msutovsky-r7 commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

dledda-r7 Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

dledda-r7 Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

dledda-r7 Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

msutovsky-r7 Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

dledda-r7 Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dledda-r7 commented Apr 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

msutovsky-r7 commented Mar 23, 2026 •

edited

Loading