SideFinder

A Windows tool for identifying and analyzing potential DLL sideloading opportunities in Portable Executable files.

SideFinder is a Windows GUI application designed to streamline the discovery and analysis of DLL sideloading opportunities in Portable Executable files. It combines static PE inspection, candidate classification, dynamic monitoring, and supporting workflows in a single interface for security research and authorized testing.

• Parses x86 and x64 PE files, including regular, delayed, bound imports, and exported functions.
• Identifies and ranks potential DLL sideloading candidates using contextual scoring and classification.
• Reviews relevant binary properties such as Authenticode signatures, CFG, CET, subsystem, architecture, and LoadLibrary usage.
• Resolves DLL search paths, KnownDLLs, missing libraries, and DLLs already present alongside the target application.
• Runs dynamic analysis to observe DLL loads and cross-reference runtime behavior with static findings.
• Scans complete directories and summarizes candidates across multiple executables and libraries.
• Optionally enriches results with the community-maintained HijackLibs dataset.
• Generates ready-to-use proxy or sideload DLLs with customizable payload options, including MessageBox, Shellcode Runner, and custom-code presets.
• Provides one-click sideload testing with a harmless MessageBox payload to confirm whether a candidate works.
• Exports analysis results and keeps an activity log for later review.

Download the latest Windows build from the latest release.

For full functionality, a C++ compiler must be installed on the Windows system running SideFinder. The application automatically scans for supported toolchains and uses an available compiler to build generated DLLs and run one-click sideload tests.

The recommended options are:

• Microsoft Visual Studio Build Tools with the Desktop development with C++ workload.
• MinGW-w64 with g++.exe available in PATH.

SideFinder detects cl.exe directly or through vswhere.exe and vcvarsall.bat, as well as g++.exe and x86_64-w64-mingw32-g++.exe. Without a supported compiler, PE analysis and source generation remain available, but generated DLLs cannot be compiled automatically and one-click sideload testing will not work.

SideFinder is a C++17 Windows application built with Dear ImGui and DirectX 11. The included Makefile cross-compiles a static x64 Windows executable from Linux using MinGW-w64.

• GNU Make
• MinGW-w64 cross compiler (x86_64-w64-mingw32-g++)
• MinGW-w64 resource compiler (x86_64-w64-mingw32-windres)

On Debian or Ubuntu, install the required toolchain with:

sudo apt update
sudo apt install make mingw-w64

Clone and compile the project:

git clone https://github.com/mxngel/SideFinder.git
cd SideFinder
make

The resulting executable will be created at:

SideFinder.exe

To remove generated build artifacts:

make clean

To create a debug build with console output:

make debug

Read the full SideFinder usage guide on redteamer.es.

SideFinder optionally integrates data from HijackLibs, a community-maintained collection of DLL hijacking candidates, to enrich its analysis results.

SideFinder is released under the MIT License.

This repository includes Dear ImGui, distributed under its own MIT License.