Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

Demos of various injection techniques found in malware

PE loader with various shellcode injection techniques

A more stealthy variant of "DLL hollowing"

Penetration testing utility and antivirus assessment tool.

Various Process Injection Techniques

Evasive Golang Loader

simple shellcode injector

ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption

This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hollowing

Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping

userland exec for Linux x86_64

Nim process hollowing loader

execute a PE in the address space of another PE aka process hollowing

RunPE using Hell's Gate technique.

process hollowing variant using NtCreateSection + NtMapViewOfSection + ResumeThread

A shellcode runner / injector / hollower in Go, for windows

Process hollowing C# shellcode runner that is FUD against Microsoft Defender as of October 7, 2023.

An implementation of the Process Hollowing technique.

Bypasses App-Bound Encryption to extract cookies, passwords, browsing history, autofill data, and payment info from Chromium-based browsers (Chrome, Brave, Edge) in user mode, without admin privileges.

OSEP sample codes from the course & more

Modular C2 loader featuring dynamic function encryption, in-memory payload support, and a covert DoH command channel, configurable via a Python builder and a Node.js web panel.

Explanation and Proof of Concept of the Process Hollowing (Windows) technique, commonly used by malware and game hackers to bypass security systems

Custom malware droppers written in multiple languages.

Execution of the malicious code is masked under a legitimate process.

"A modular framework for advanced EDR evasion on Windows x64, featuring dynamic syscalls, AES encryption, and process hollowing. 85% evasion rate against Sysmon."

CLI tool for shielding your app from static and dynamic analysis

This project provides a proof-of-concept implementation of the "Process Overwriting" (a form of Process Hollowing) technique in plain C.

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Proof of Concept demonstrating a stealthy code loading technique (Process Doppelgänging / Phantom File variations) using Transactional NTFS (TxF) and kernel function hooking.