WithSecureLabs / doublepulsar-usermode-injector

A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Well...

opened this issue · comments

This is a nice code.
But, i have noticed it before microsoft.

I understand your code too good, that this :
http://resources.infosecinstitute.com/code-injection-techniques/#gref

Make me think. Since GetProcAddress will return the address of LoadLibrary. And well

QueueUserAPC is the same at both, except this little detail. Can we discuss about this ?
It uses the VirtualAllocEx to allocate a size of shellcode_size ?