Safe BlackBox DLL Injector 1.0.2 - Advanced Windows DLL Injector | 6 Injection Methods & Crash Triage | Open Source

BlackBox DLL Injector 1.0.2
High-Performance Pure Rust DLL Loader with In-Memory Manual Mapping & Crash Triage

​

• Method 0: Standard (CreateRemoteThread)
  The classic, tried-and-true injection method. Simple, highly reliable, and works on almost all standard applications and DLLs.
• Method 1: Native NT Loader (LdrLoadDll)
  Calls the low-level Windows loader directly inside ntdll.dll. It skips high-level kernel32 initialization, helping you bypass common user-mode API hooks.
• Method 2: Manual Map (In-Memory PE Loader)
  Loads your DLL directly into target memory without registering it in the Windows module list. Unlike older manual mappers that crash complex DLLs, BlackBox fully handles:
  • Full C++ exception support (try / catch and SEH) so your DLL won't instantly crash when an exception is thrown.
  • Complete TLS support (both thread-local storage variables and TLS callbacks).
  • Proper section memory protections and automatic import resolution.
• Method 3: Thread Hijacking
  Hijacks an existing, already-running thread inside the target process to load your DLL and immediately restores it. Creates zero new threads, avoiding detection from basic thread creation monitors.
• Method 4: NtCreateThreadEx
  Uses direct native system calls to spawn an injection thread while applying the ThreadHideFromDebugger flag to keep it hidden from attached debuggers.
• Method 5: Threadless APC (QueueUserAPC)
  Queues your DLL load onto an existing thread waiting in an alertable state. Completely threadless injection without spawning a single new thread.

• Instant Crash Diagnostics & Error Reports
  Tired of injectors closing silently or showing a useless "Injection Failed" error? If anything goes wrong or your game crashes, BlackBox immediately inspects the process, decodes the crash dump, and pops up a clear report telling you the exact reason (e.g. Access Violation 0xC0000005, missing DLL, or bad forwarder) with a 1-click Copy Report button for easy troubleshooting.
• Automatic VC++ Dependency Detection
  Scans your DLL before injecting to check if you are missing required Visual C++ Redistributable runtimes (such as vcruntime140.dll or msvcp140.dll). Instead of letting your game crash silently, it tells you upfront exactly which runtime you need to install.
• Windows 11 & Core Isolation Ready
  Old injectors built years ago regularly crash on modern systems. BlackBox is written from scratch in pure Rust with zero third-party dependencies, running smoothly on Windows 10 and modern Windows 11 even with Core Isolation / Memory Integrity (HVCI) turned on.
• Full 64-bit (x64) and 32-bit (x86) Support
  Works seamlessly on both 64-bit and 32-bit (WOW64) applications. BlackBox automatically detects bitness mismatches so you never accidentally try to load a 32-bit DLL into a 64-bit process.
• Built-In PE Cloaking & Scrambler
  Includes optional stealth options right in the UI: erase PE headers from memory (ErasePE), unlink modules from the active PEB list (HideModule), and scramble binary signatures before loading.

Showcase

• Official Releases & Changelogs: All future version updates and latest pre-compiled standalone executables, will be posted directly here.
• Troubleshooting & Help: If an injection fails or a target exits unexpectedly, hit "Copy report" on the BlackBox diagnostic popup and paste it into a reply. The report pinpointing missing DLLs, dependency forwarders, or access violations makes troubleshooting instant.
• Feedback & Suggestions: Feel free to share feedback, feature requests, or compatibility reports with different DLL payloads.

• Full Source Code: Inspect the complete pure Rust codebase, review native Win32/NTAPI implementations, or audit the memory loaders yourself.
• Issue Tracker & Reporting: Submit bug reports, request new features, or report compatibility issues with specific Windows builds.

1.0.2​

• Changed: manual-map static TLS now registers the mapped image directly with LdrpHandleTlsData; the loader-visible seed DLL fallback was removed. The internal function is resolved from the matching ntdll PDB, cached in %TEMP%\BlackBoxInjector\symbols.
• Fixed: a target that is already gone, or a missing/undownloadable ntdll PDB, now uses the normal error dialog (E2003 TARGET_NOT_RUNNING / TLS-PDB-01) and no longer writes a failure report.

1.0.1​

• Fixed: manual map static TLS now builds a real seed DLL sized exactly to the payload's TLS template. No fixed capacity, no unsafe manual thread-array fallback.
• Fixed: Standard and NtCreateThreadEx capture the 64-bit HMODULE through a remote stub and verify the PE at that base. DLLs that unlink themselves no longer produce a false "not in the module list" error.
• Fixed: crash reports map the WER exception code and fault offset correctly; the module timestamp is no longer shown as the exception code.
• Fixed: --cli ... > log.txt and pipes keep the caller's standard handles.
• Changed: one embedded TLS base seed instead of a size ladder; smaller binary and no 128 KB ceiling.
• Added: the TLS seed source (seed/tls_seed.cpp) and rebuild script (seed/build.cmd), so the prebuilt base DLL is reproducible and auditable.

1.0.0​

• Initial release: six injection methods, manual map with TLS and C++ exception support, cloaking, crash diagnostics, CLI.

fzuv said:

slop

Click to expand...

• Fixed: manual map static TLS now builds a real seed DLL sized exactly to the payload's TLS template. No fixed capacity, no unsafe manual thread-array fallback.
• Fixed: Standard and NtCreateThreadEx capture the 64-bit HMODULE through a remote stub and verify the PE at that base. DLLs that unlink themselves no longer produce a false "not in the module list" error.
• Fixed: crash reports map the WER exception code and fault offset correctly; the module timestamp is no longer shown as the exception code.
• Fixed: --cli ... > log.txt and pipes keep the caller's standard handles.
• Changed: one embedded TLS base seed instead of a size ladder; smaller binary and no 128 KB ceiling.
• Added: the TLS seed source (seed/tls_seed.cpp) and rebuild script (seed/build.cmd), so the prebuilt base DLL is reproducible and auditable.

erw said:

Yo cool project but the mm is really lagging ist loading 0.5 sec 10 time when you close or open menu

Click to expand...

erw said:

ehm so when I mm its laging extreme

Click to expand...

erw said:

no only one

Click to expand...

erw said:

When i inject with mm (and press inject ofc) it will lag really hard

Click to expand...

SaliMake said:

Hey goat

None of the methods are working for CS2

I changed mm myself and stopped LoadLibrary of the TLS seed and now it loads but cs crashes almost instantly after
From settings even had everything off from PE Scrambler, Advanced cloaking and cloaking & evasion options expect for auto inject

Click to expand...

SaliMake said:

Hey goat

None of the methods are working for CS2

I changed mm myself and stopped LoadLibrary of the TLS seed and now it loads but cs crashes almost instantly after
From settings even had everything off from PE Scrambler, Advanced cloaking and cloaking & evasion options expect for auto inject

Click to expand...

UPDATE 1.0.2​

• Changed: manual-map static TLS now registers the mapped image directly with LdrpHandleTlsData; the loader-visible seed DLL fallback was removed. The internal function is resolved from the matching ntdll PDB, cached in %TEMP%\BlackBoxInjector\symbols.
• Fixed: a target that is already gone, or a missing/undownloadable ntdll PDB, now uses the normal error dialog (E2003 TARGET_NOT_RUNNING / TLS-PDB-01) and no longer writes a failure report.

Plisskien said:

ah, now I understand, I'll try to push update today! But can I get a bit more info, such as what is your windows version, which dll are you trying to inject and where? In that case I can reproduce the issue.

Click to expand...

erw said:

Ehm Im on newest windows 10 version 22h2 and it happens with every dll I tryed. So when I press on inject than the classic windows blue loading circle loobs and after 10 sec it stops but when I close the menu it start all over again. But the standart works fine.

Click to expand...