Skip to content

DoubleLabyrinth/ProcessHollowing

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Process Hollowing

1. SectionRemapLoader

SectionRemapLoader uses NtUnmapViewOfSection, NtCreateSection and NtMapViewOfSection to perform process hollowing. This way is much more easier, but requires a valid PE image file on disk.

MAKE SURE ARCHITECTURE MATCHES. i.e. launch 32-bits process with SectionRemapLoader.exe built in 32-bits mode OR launch 64-bits process with SectionRemapLoader.exe built in 64-bits mode.

Usage:
    SectionRemapLoader.exe <exe to load> <exe to launch> [args...]

Example:

$ .\SectionRemapLoader.exe C:\Windows\write.exe C:\Windows\Notepad.exe

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Languages