DLL Override Functions

The Windows commercial payload can bind an exported method from a loaded DLL to an internal override function. This reference lists the accepted function names and the DLL method contracts in the current AgentPower implementation. Use the commercial native commands to manage loaded DLLs and bindings.

Binding and DLL lifecycle

Loaded DLLs, their IDs, and function bindings belong to the running agent process. Commands in that process share this registry. The registry starts empty when the agent process starts; its contents do not survive a restart.

override-load maps a DLL into the agent process and assigns it a numeric ID. Its name is a display label; override-set selects the DLL by ID. Loading runs the DLL's initialization callbacks, including DllMain when present, but does not call an override export until that function is bound and reached. The DLL must match the agent process architecture (x86 or x64). When present, DllMain uses the standard BOOL WINAPI(HINSTANCE, DWORD, LPVOID) signature and receives process attach and detach notifications.

override-set takes a case-sensitive functionality name from the table below and a method name exported by the loaded DLL. The export name may differ from the functionality name. The agent checks that the functionality, DLL ID, and named export exist; it does not check the export's signature. override-list shows the DLL IDs, exported names, and current bindings.

Each functionality has one binding. A successful override-set for an already-bound function replaces its previous binding; the previous DLL remains loaded. There is no stack of bindings to restore later.

override-unset removes the binding so future calls use the built-in path. It leaves the DLL loaded and does not invoke callback cleanup or undo effects of earlier calls. Unsetting a recognized function that is already unbound succeeds without changing anything.

override-unload removes every binding to the selected DLL before unloading it. Unloading an absent DLL ID succeeds without changing anything. The command also supports unloading all override DLLs.

Warning

Removing a binding does not wait for callbacks already underway to finish. override-list reports bindings, not active calls, so its output cannot establish that a DLL is safe to unload. Automatic unbinding before unload does not provide a guarantee that the DLL is no longer in use.

For command parameters, see override-set, override-unset, and override-unload.

DLL method definitions

In the signatures below, Method stands for the DLL export selected by the method parameter. Every callback uses the Windows __stdcall calling convention. The types and parameter order must match the selected function; a successful override-set only proves that the export name was found.

functionality	DLL export signature	Invocation and result
AllocateSelf	PVOID __stdcall Method(LPVOID data, unsigned int size)	Receives data for allocation and writing in the agent process; returns the resulting address.
FreeSelf	void __stdcall Method(LPVOID data)	Releases an address in the agent process.
AllocateOther	PVOID __stdcall Method(HANDLE proc, LPVOID data, unsigned int size)	Receives a target process handle and data for allocation and writing; returns the resulting address.
FreeOther	void __stdcall Method(HANDLE proc, LPVOID data)	Releases an address associated with the target process handle.
AmsiBypass	void __stdcall Method(unsigned int codeThreadNr)	Called on a new code-thread event instead of the built-in AMSI handler; receives that handler's event count.
EtwBypass	void __stdcall Method(unsigned int codeThreadNr)	Called on a new code-thread event instead of the built-in ETW handler; receives that handler's event count.
DotNetExecute	bool __stdcall Method(LPVOID data, unsigned int size)	Receives assembly bytes during the .NET executable path and returns success or failure. The .NET DLL execution path does not use this hook.
ShellcodeExecute	bool __stdcall Method(LPVOID data, unsigned int size)	The name can be bound, but the current AgentPower code has no call site for it. Binding it has no runtime effect.
PadShellcode	LPVOID __stdcall Method(LPVOID data, unsigned int size, unsigned int paddingSize, unsigned int* outSize)	Called when configured padding is applied; returns the output buffer and writes its byte count to outSize.
EncodeShellcode	LPVOID __stdcall Method(LPVOID data, unsigned int size, unsigned int* outSize)	Called for each configured encoding pass; returns the output buffer and writes its byte count to outSize.

Warning

The agent does not validate callback signatures. A mismatched calling convention, parameter list, or result can fail or destabilize the process. Keep allocation and release methods compatible. The padding and encoding paths copy the returned buffer and then release it with VirtualFree(..., MEM_RELEASE); their returned memory must be compatible with that release.

The allocation and release callbacks do not cover every memory path: the reusable read-write-execute (RWE) section and direct allocation methods can bypass them. DotNetExecute receives only the assembly bytes and size; its callback is not passed the command arguments or AppDomain options. The AmsiBypass and EtwBypass callbacks replace their respective built-in handlers when called.

Info

These are runtime override DLL exports. They are separate from the generated payload's dllMethodName, the load-dll command's methodName, and native DLL ExecUnit entry points.

Implementation references

This reference describes payload revision 0023aa38439ac06f910c18daac4b4abf99899f15. The callback types are defined in AgentPower/AgentPower/Overrides.h; accepted names and binding behavior are in Overrides.cpp. Call sites are in rwe/RweAllocate.cpp, edr/AmsiBypass.cpp, edr/EtwBypass.cpp, and plugins/payload_executions/DotNetViaCom.cpp. The DLL lifecycle is in specials/DllLoader.cpp, and the five command handlers are in commands/natives/overrides/.

Build switches can make an advertised command unavailable: _DISABLE_OVERRIDES makes the override commands return an error, and _DISABLE_DLL_LOADER prevents override-load from loading the DLL. See Agent Capabilities for the current metadata caveat.