/process_doppelganging

My implementation of enSilo's Process Doppelganging (PE injection technique)

Primary LanguageC

Process Doppelgänging

Build status

This is my implementation of the technique presented by enSilo:
https://www.youtube.com/watch?v=Cch8dvp836w

Characteristics:

  • Payload mapped as MEM_IMAGE (unnamed: not linked to any file)
  • Sections mapped with original access rights (no RWX)
  • Payload connected to PEB as the main module
  • Remote injection supported (but only into a newly created process)
  • Process is created from an unnamed module (GetProcessImageFileName returns empty string)
WARNING:
The 32bit version works on 32bit system only.