Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
memory-relocalloc — C proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory allocation calls. | Kitploit
Tools/GitHubGitHub/gmh5225/memory-relocalloc
Memory ForensicsExploitationReverse EngineeringShellcodePost-ExploitationMalware AnalysisRed TeamingPayload DevelopmentBinary Exploitation
GitHubgmh5225/memory-relocalloc

memory-relocalloc

C proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory allocation calls.

214 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View RepositoryWebsite

RelocAlloc: Using .reloc section to replace the typical allocation calls


Explaining the code:

  • We first, locate the addresses of all the dlls mapped to our process.
  • We then construct an array of structs and we fill it up with some data, thats Initialize() function.
  • Now, we have a full array, next step is to search for the right address.
  • calling GetSuitableAddress(SIZE_T ShellcodeSize) will do the job; thats finding us the right code cave (empty place in memory, fitting the shellcode size)
  • in case it is found it will be returned.
  • to use it we must adjust memory protection to be writable/executable ... (the poc is directly rwx)

Demo:

img1 img2

Note: this only work with small shellcodes, bcz it depends on the dlls mapped, the bigger the .reloc section, the bigger chances of getting a valid address. In addition, this is tested only on a x64 machine, but it should work for x86 (i think :p)



# STAY TUNED FOR MORE
120064592-a5c83480-c075-11eb-89c1-78732ecaf8d3
Download Tool