⚡ We Inject DLL

Advanced Python DLL Injector
Made by Hardik — github.com/ewwhardik

---

Features

Feature	Description
Process List	Live scan with search, filter by mode (All / Windowed / 64-bit / 32-bit / Games)
Multi-DLL Injection	Queue multiple DLLs, enable/disable each individually
Drag & Drop	Drop DLL files directly onto the queue panel
5 Injection Methods	Standard, LdrLoadDll Stub, LdrpLoadDll Stub, Thread Hijacking, Manual Map
Stealth Inject	Routes through ntdll to avoid CreateRemoteThread detection
DLL Scrambling	Copies DLL to a randomised temp filename before injection
Auto-Inject	Watches for a target process name and injects automatically on launch
Step-by-Step	Pauses for confirmation between each injection step
Close on Inject	Automatically exits the tool after successful injection
64-bit Support	Full x64 shellcode for 64-bit target processes
Un-inject	FreeLibrary on a named module in any process
Execute Export	Call a named exported function after injection
Injection History	View all past injection results in-session
Debug Console	Live log viewer wired to Python's logging framework
Error Debugging	Full traceback capture and display for every failure

---

Installation

# 1. Clone
git clone https://github.com/ewwhardik/weinject-dll
cd weinject-dll

# 2. Install dependencies
pip install customtkinter psutil Pillow darkdetect

# 3. Run (Windows recommended; demo mode on other platforms)
python main.py

Requirements

• Python 3.10+
• Windows 10/11 x64 (for actual injection)
• customtkinter, psutil (pip install)
• Administrator privileges recommended

---

Injection Methods

Standard — CreateRemoteThread + LoadLibraryA

The classic method. Allocates memory in the target, writes the DLL path, then calls LoadLibraryA via CreateRemoteThread.

LdrLoadDll Stub

Calls ntdll!LdrLoadDll instead of kernel32!LoadLibraryA via a custom x64 shellcode stub. Avoids the LoadLibraryA hook that many anti-cheats patch.

LdrpLoadDll Stub

Pattern-scans ntdll in-process for the internal (non-exported) LdrpLoadDll function, then calls it directly. The most stealthy of the thread-based methods.

Thread Hijacking

• Enumerates threads of the target process
• Suspends the first thread
• Saves the current RIP
• Overwrites RIP with a shellcode stub that calls LoadLibraryA
• Restores the original RIP on completion

Manual Map

Full PE manual mapper:

1. Reads and parses the DLL's PE headers
2. Allocates SizeOfImage bytes in the remote process
3. Maps headers + sections manually
4. Applies base relocations (Delta patching)
5. Resolves the import table (IAT fixing)
6. Calls DllMain via remote thread

---

Test DLL

The test_dll/ directory contains a test payload that displays a MessageBox on injection.

Building (Windows with MinGW)

cd test_dll
python build_dll.py

Exported functions

Name	Description
Initialize	Shows a "Export executed" MessageBox
SayHello	Shows a hello MessageBox
GetVersion	Returns version string

Cross-compile on Linux/macOS

sudo apt install mingw-w64
python test_dll/build_dll.py

---

Project Structure

WeInjectDLL/
├── main.py               # GUI application entry point
├── injection_engine.py   # All injection logic (5 methods + stealth + uninject)
├── process_scanner.py    # Process enumeration with psutil / WinAPI fallback
├── README.md
└── test_dll/
    ├── test_payload.c    # Test DLL source (C)
    └── build_dll.py      # Build helper script

---

Usage

1. Launch python main.py (as Administrator for full access)
2. Select a process from the Process List on the left
3. Add DLL(s) via + Add or drag & drop into the queue panel
4. Configure options in the right panel:
   • Choose an injection method
   • Toggle Stealth, Scrambling, Auto-Inject, etc.
5. Click 💉 INJECT
6. Watch the progress dialog and injection log

---

⚠ Disclaimer

This tool is provided for educational purposes and authorized security research only.
Do not inject DLLs into processes you do not own or have explicit permission to modify.
The author assumes no responsibility for misuse.

---

Made by Hardik — github.com/ewwhardik