⛔ In-depth reference
- Complete component library list (85 components) → references/loader-components-db.json
- Existing scenarios (avoid duplication) → references/loader-scenarios.json
- Architecture description and templates → references/loader-architecture.md
4-component selection matrix
Loader = Storage × Allocator × Copier × Executor
Storage (storage method) — 15 types
Internal embedding | Resource section | Remote URL | Registry | ADS | ...
Allocator (memory allocation) — 14 types
| Method | Complexity | Code pattern |
|---|---|---|
| VirtualAlloc | simple | VirtualAlloc(NULL, size, MEM_COMMIT|MEM_RESERVE, PAGE_RWX) |
| HeapCreate | medium | HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0) |
| NtAllocateVirtualMemory | complex | Direct NT syscall |
Copier (data copying) — 9 types
memcpy | RtlMoveMemory | Loop byte copy | WriteProcessMemory | ...
Executor (execution method) — 47 types
| Method | Complexity |
|---|---|
| Function pointer | simple |
| CreateThread | simple |
| EnumWindows callback | medium |
| APC injection | medium |
| Fiber | complex |
| NtCreateThreadEx | complex |
Generation process
1. 查组件库 → references/loader-components-db.json
2. 查已有场景 → references/loader-scenarios.json（避免重复）
3. 选择 4 组件组合
4. 选择语言（C/C++/Rust）
5. 生成代码（使用 references/loader-architecture.md 中的模板）
6. 交叉编译验证（mingw-gcc / cargo）
7. 记录场景到知识库
Compilation command quick reference
# C
x86_64-w64-mingw32-gcc -o loader.exe loader.c
# C++
x86_64-w64-mingw32-g++ -o loader.exe loader.cpp
# Rust
cargo build --release --target x86_64-pc-windows-gnu
Rust Loader notes
- Rust error handling: use Result / Option types, avoid unwrap panic