Reflective PE Injector, which forces the remote process to read local memory instead of using WriteProcessMemory
Not tested on x64 yet.
Usage:
-
Create a GHOSTWRITER context
-
Initialize it with InitGhostWriter
-
If all went well, you can now get a thread from any process in the system (create one in the process for simplicity) and call PrepareThread on it
-
If GWPrepareThread succeeds, you can now use GWriteMemory and GWCall to do your thing 4.1 (optional) use the reflective injector with the prepared thread.
-
(optional) Once you've finished your work, you can use GWResumeThread to restore it to its original state.
Note: If you use the included injector with the INJECTOR_AUTO_RUN flag, the thread you provide will be used for executing your payload, so calling GWResumeThread under such circumstances will be ineffective.