Purpose

A simple PoC for an injection technique that uses PPID Spoofing to spawn a child process under a browser, then it performs process hollowing using the encrypted payload from resources.

Note

• I tried to replicate the disassembly of PMA's lab12-02 so some stuff might have better implementation options.
• I'm open to suggestions but still not sure if I will update this project.

Video

video.mp4

Building code

configure the project

cmake -S . -B build

To build all projects.

cmake --build build 

To build a specific project

cmake --build build --target <project_name>

By default the project will be built using Debug config, though it can be configured using --config parameter

cmake --build build --config Release --target <project_name>

You can always omit project_name to build all projects.

To run the project you will find the final exe at build/<project_name>/<config>/ (e.g: build/getVersion/Release).

References

• Concealed Code Execution
• iredteam - Process Hollowing and Portable Executable Relocations
• iredteam - PPID Spoofing
• allthingsida - Understanding PE+ file format
• msdn - PE Format

Special Thanks

• Omar Mokhtar
• GG