Skip to content

Process Hollowing PoC to make gameplay enhancers undetected

Notifications You must be signed in to change notification settings

hellokittyfan48/process-hollowing

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

14 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Process Hollowing

Process Hollowing involves the execution of custom arbitrary code within the memory space of a legitimate process

How it works

  • The target process is created with the suspended flag
  • PBI is acquired using NtQueryInformationProcess
  • Memory gets allocated for the new image base (RWX gets picked up by defender)
  • Original code is unmapped
  • Shellcode is written to the allocated memory space
  • Image base is rewritten using the PBI and the offset of 0x10
  • A new thread is created at entry point
  • Execution is resumed so everything is ran in the context of the legit process
  • Clean up

Usage

x64

  • Clone the repo
  • Put your PE shellcode into the shellcode buffer in hdr/shellcode.h
  • Build in Release | x64

x86

  • Clone the repo and hardcode your shellcode in hdr/shellcode.h
  • You can get the shellcode using the provided shellcode converter
  • If you wish to merge these 2 solutions, go ahead and open a pull request

Resources

Need help?

You can find my Discord here

Note

  • Subsystems of both executables should be matching
  • If you tweak this enough it will bypass most UM anticheats
  • This is for EDUCATIONAL PURPOSES ONLY

Leave a 🌟 if you like it <3

About

Process Hollowing PoC to make gameplay enhancers undetected

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published