process_doppelganging

Open source

My implementation of enSilo's Process Doppelganging (PE injection technique)

650 stars0 likes1 views

About

My implementation of enSilo's Process Doppelganging (PE injection technique)

This is my implementation of the technique presented by enSilo:

Payload mapped as MEM_IMAGE (unnamed: not linked to any file)
Sections mapped with original access rights (no RWX)
Payload connected to PEB as the main module
Remote injection supported (but only into a newly created process)
Process is created from an unnamed module (GetProcessImageFileName returns empty string)

WARNING:

The 32bit version works on 32bit system only.