Skip to content
This repository was archived by the owner on Apr 5, 2025. It is now read-only.

Commit 5bcefa0

Browse files
authored
Update README.md
1 parent 1d26844 commit 5bcefa0

File tree

1 file changed

+37
-8
lines changed

1 file changed

+37
-8
lines changed

README.md

+37-8
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,44 @@
11
# What is Process Injection?
22
* It is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process’s memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
33

4-
# TECHNICAL DETAILS
5-
6-
* Open process with Access Rights
7-
* LPTHREAD_START_ROUTINE (its a pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process.)
8-
* VirtualAllocEx (used to allocate space from the target process virtual memory)
9-
* WriteProcessMemory (used to write the path of the shellcode into the allocated memory)
10-
* CreateRemoteThread (used to creates a thread in the virtual memory area of a process)
11-
* WaitForSingleObject (Waits until the specified object is in the signaled state or the time-out interval elapses)
4+
### ****TECHNICAL DETAILS****
125

6+
- ****OpenProcess API****
7+
8+
Opens an existing local process object and return an open handle to the specified process.****
9+
10+
**Parameters**
11+
12+
`[in] dwDesiredAccess`
13+
14+
The access to the process object. This access right is checked against the security descriptor for the process. This parameter can be one or more of the [process access rights](https://docs.microsoft.com/en-us/windows/desktop/ProcThread/process-security-and-access-rights).
15+
16+
If the caller has enabled the SeDebugPrivilege privilege, the requested access is granted regardless of the contents of the security descriptor.
17+
18+
`[in] bInheritHandle`
19+
20+
If this value is TRUE, processes created by this process will inherit the handle. Otherwise, the processes do not inherit this handle.
21+
22+
`[in] dwProcessId`
23+
24+
The identifier of the local process to be opened.
25+
26+
If the specified process is the System Idle Process (0x00000000), the function fails and the last error code is `ERROR_INVALID_PARAMETER`. If the specified process is the System process or one of the Client Server Run-Time Subsystem (CSRSS) processes, this function fails and the last error code is `ERROR_ACCESS_DENIED` because their access restrictions prevent user-level code from opening them.
27+
28+
If you are using [GetCurrentProcessId](https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-getcurrentprocessid) as an argument to this function, consider using [GetCurrentProcess](https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-getcurrentprocess) instead of OpenProcess, for improved performance.
29+
30+
- VirtualAllocEx API
31+
32+
Reserves a region of memory within the virtual address space of a specified process, The function initializes the memory it allocates to zero and return the base address of the allocated memory .
33+
34+
- WriteProcessMemory API
35+
36+
Writes data to an area of memory in a specified process. The entire area to be written to must be accessible or the operation fails.****
37+
38+
- **CreateRemoteThread API**
39+
40+
Creates a thread that runs in the virtual address space of another process and return a handle to the new thread.
41+
1342

1443
# DEMO
1544

0 commit comments

Comments
 (0)