fengjixuchui / process_doppelganging

My implementation of enSilo's Process Doppelganging (PE injection technique)

Home Page:https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Process Doppelgänging

Build status

This is my implementation of the technique presented by enSilo:
https://www.youtube.com/watch?v=Cch8dvp836w

Characteristics:

  • Payload mapped as MEM_IMAGE (unnamed: not linked to any file)
  • Sections mapped with original access rights (no RWX)
  • Payload connected to PEB as the main module
  • Remote injection supported (but only into a newly created process)
  • Process is created from an unnamed module (GetProcessImageFileName returns empty string)

WARNING:
The 32bit version works on 32bit system only.

About

My implementation of enSilo's Process Doppelganging (PE injection technique)

https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/


Languages

Language:C 83.9%Language:C++ 15.7%Language:CMake 0.4%