{"id":13699768,"url":"https://github.com/secrary/InjectProc","last_synced_at":"2025-05-04T17:30:54.633Z","repository":{"id":138366013,"uuid":"92487544","full_name":"secrary/InjectProc","owner":"secrary","description":"InjectProc - Process Injection Techniques [This project is not maintained anymore]","archived":false,"fork":false,"pushed_at":"2019-02-10T11:05:15.000Z","size":71,"stargazers_count":998,"open_issues_count":3,"forks_count":212,"subscribers_count":67,"default_branch":"master","last_synced_at":"2025-05-01T01:56:14.377Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/secrary.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-05-26T08:08:20.000Z","updated_at":"2025-02-17T13:34:12.000Z","dependencies_parsed_at":null,"dependency_job_id":"17514c3d-f58c-4d8c-83de-b258a890e58b","html_url":"https://github.com/secrary/InjectProc","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secrary%2FInjectProc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secrary%2FInjectProc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secrary%2FInjectProc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secrary%2FInjectProc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/secrary","download_url":"https://codeload.github.com/secrary/InjectProc/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252371644,"owners_count":21737372,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T20:00:43.152Z","updated_at":"2025-05-04T17:30:54.187Z","avatar_url":"https://github.com/secrary.png","language":"C++","funding_links":[],"categories":["C++","C++ (225)"],"sub_categories":[],"readme":"# InjectProc\n\nProcess injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors.\n\nThere are several techniques, which are commonly used:\nDLL injection, process replacement (a.k.a process hollowing), hook injection and APC injection.\n\nMost of them use same Windows API functions: \nOpenProcess, VirtualAllocEx, WriteProcessMemory, for detailed information about those functions, use MSDN.\n\n## DLL injection:\n* Open target process.\n* Allocate space.\n* Write code into the remote process.\n* Execute the remote code.\n\n## Process replacement:\n* Create target process and suspend it.\n* Unmap from memory.\n* Allocate space.\n* Write headers and sections into the remote process.\n* Resume remote thread.\n\n## Hook injection:\n* Find/Create process.\n* Set hook\n## Note: \n`InjectProc` uses [SetWindowsHookEx](https://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx) function, you can try different ways to installing hooks, for example, [EasyHook](http://easyhook.github.io/tutorials/nativeremotehook.html)\n\n## APC injection:\n* Open process.\n* Allocate space.\n* Write code into remote threads.\n* \"Execute\" threads using QueueUserAPC.\n\n## Download\n[Windows x64 binary](https://github.com/secrary/InjectProc/releases) - x64 bit DEMO\n## Dependencies: \n[vc_redist.x64](https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads) - Microsoft Visual C++ Redistributable\n## DEMO\n[InjectProc DEMO - Process Injection Techniques](https://www.youtube.com/watch?v=hLPDq9nSHMw)\n\n## Contributors\n- [nullbites](https://github.com/nullbites)\n\n# Warning\nWorks on Windows 10 build 1703, 64bit.\n\nI've not enough time to test other systems and make it portable if you have enough time please contribute.\n\nI create this project for me to better understand how process injection works and \nI think it will be helpful for many beginner malware analysts too. \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecrary%2FInjectProc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecrary%2FInjectProc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecrary%2FInjectProc/lists"}