Process injection and memory manipulation

Overview: Process injection and memory manipulation are advanced techniques that allow you to interact with running processes at a low level, usually by injecting code or manipulating their memory spaces. These techniques are widely used in both security research and offensive security operations. While they have legitimate uses for debugging, reverse engineering, and penetration testing, they can also be employed by attackers to bypass security measures, escalate privileges, and persist within a system.

This category explores a wide variety of process injection techniques, each designed to inject code into a running process's memory and gain control of its execution flow. We'll cover methods such as injecting shellcode, remote thread creation, and more sophisticated techniques like code caves and reflective DLL injection.

1. Suspended Process Injection

   • What is it?: A method where you create a process in a suspended state (e.g., CreateProcess with CREATE_SUSPENDED) and then inject shellcode into it before resuming the process.

   • How it works: After creating the process in a suspended state, memory is allocated in the target process, shellcode is written, and execution is resumed using ResumeThread.

   • Usage: Often used when you want to control the target process from the start and avoid potential interference from the process's normal execution flow.

2. Basic Shellcode Injection 🐍

   • What is it?: The process of injecting raw, often obfuscated shellcode into a target process's memory and executing it.

   • How it works: Shellcode is typically injected via memory allocation (VirtualAllocEx), writing the shellcode to that memory (WriteProcessMemory), and then creating a thread to execute the code (CreateRemoteThread).

   • Usage: Commonly used by attackers to execute arbitrary code in a target process.

3. Reflective DLL Injection 🔀

   • What is it?: Injecting a DLL into a remote process without the need for LoadLibrary or other API calls, often used by attackers to hide the injection.

   • How it works: A reflective DLL is a self-contained DLL that includes its own code to load itself into the target process. The DLL code is injected into the target process, and then its entry point is called to execute the code.

   • Usage: Common in malware and rootkits because it bypasses traditional detection methods.

4. DLL Injection via SetWindowsHookEx 🧩

   • What is it?: A technique where a DLL is injected into a target process by setting a hook via the SetWindowsHookEx API.

   • How it works: The injected DLL is loaded into a target process via the hook mechanism, allowing you to intercept events and execute code inside the target process’s address space.

   • Usage: Frequently used for keylogging, mouse event capturing, or other types of stealth attacks.

5. Thread Injection (Direct Thread Hijacking) 🧵

   • What is it?: In this method, rather than creating a new remote thread, you hijack an existing thread in the target process and modify it to execute shellcode.

   • How it works: The thread is suspended using SuspendThread, its context is modified to point to the shellcode, and then the thread is resumed to run the injected code.

   • Usage: Typically used to manipulate already running processes without needing to create new threads.

6. Code Injection via NtCreateThreadEx 🧑‍💻

   • What is it?: A lower-level technique for creating a thread inside a target process. NtCreateThreadEx allows more control over thread creation compared to CreateRemoteThread.

   • How it works: This function can be used to directly create a remote thread in a target process with specific parameters, bypassing some restrictions of CreateRemoteThread.

   • Usage: A useful tool when dealing with more secure or protected environments where CreateRemoteThread may be blocked.

7. Process Hollowing 💀

   • What is it?: Process hollowing is a technique where the memory of a suspended process is replaced with the injected shellcode, effectively hijacking the target process.

   • How it works: The target process is created in a suspended state, and its memory is "hollowed out" by unmapping its original code and replacing it with shellcode.

   • Usage: Common in malware, particularly for evading detection by using legitimate processes to run malicious code.

8. Using ZwUnmapViewOfSection to Overwrite Process Memory 🛠️

   • What is it?: A technique that involves unmapping a section of a process’s memory to write shellcode over it, effectively injecting it.

   • How it works: This method involves using ZwUnmapViewOfSection to remove existing memory mappings and then writing shellcode into the freed-up memory space.

   • Usage: Often used in sophisticated attacks to manipulate processes without leaving obvious traces.

9. Memory Manipulation via Heap Injection 🏗️

• What is it?: A method where shellcode is injected into the heap space of a process, which is used by the process for dynamic memory allocation.

• How it works: The heap memory is allocated and modified by directly manipulating heap structures to store shellcode, which is then executed.

• Usage: This technique allows attackers to insert code into a process in a way that avoids detection and bypasses some security measures.

---

Why is Process Injection & Memory Manipulation Important?

💻 Security Research: By understanding how these techniques work, security researchers can better defend against them by identifying and mitigating injection methods.

🛡️ Malware Analysis: These techniques are often used in malicious software to execute hidden payloads, which makes them critical to analyze for defensive strategies.

🔍 Exploit Development: Offensive developers often use process injection and memory manipulation to bypass security defenses, escalate privileges, and gain control of target systems.

---

Disclaimer:

Yeah, we are able to manipulate memory with GO.

C/C++ psychos reading this