Warning
Only use this in a sandboxed environment, where any uncaught injections cant cause harm!
PoC executable to catch and dump any attempted code injections (locally).
- Catch remote threads
- Catch thread hijacking
- Dump any recently allocated memory
- Dump memory where thread was started
- Reconstruct some manually mapped PEs
- Supports both 32 and 64 bit
Note
Due to how console apps work (and I'm lazy), closing it normally does not work and it instead needs to be killed via Task Manager or another external tool.
- (Optional) rename InjectDumper.exe to the name of the process that the injector targets
- Start InjectDumper (does NOT support injections that happen before the programs entry point)
- Start program that injects code into InjectDumper
- Start looking at the resulting memory/threads