> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/cobalt-strike/beacon-payloads/stomped-loader.md).

# Stomped Loader

Beacon was origninally implememnted as 'reflective' DLL, based on [Stephen Fewer's work](https://github.com/stephenfewer/ReflectiveDLLInjection). This type of DLL exports a function, which is responsible for re-loading its own image into memory and performing tasks such as loading dependant modules. The 'overview' section of Stephen's repository goes through the various steps in more detail. Beacon's DLL exports a function called **ReflectiveLoader,** which when called, walks back over its own image, maps a new copy of itself into memory, and call its entry point. Because the DLL is exported as shellcode, a small shellcode stub must be written over PE's DOS header. This shellcode is responisble for jumping code execution to the exported ReflectiveLoader, which lives in the PE's .text sections.

<figure><img src="https://images.gitbook.com/__img/dpr=2,width=760,onerror=redirect,format=auto,signature=-993466446/https%3A%2F%2Flwfiles.mycourse.app%2F66e95234fe489daea7060790-public%2Feef700639f25153a0886a505ec3492d1.png" alt=""><figcaption></figcaption></figure>