Process Hollowing is a technique where a legitimate process is created in a suspended state, its memory is unmapped and replaced with malicious code.
- Implementation of Process Hollowing technique
- Process creation in suspended state
- Memory manipulation using Windows API
- PE header manipulation
- Shellcode injection
- Process resumption
- Rust toolchain
- Required dependencies:
- winapi
- ntapi
- Clone the repository
- Navigate to the project directory
- Run
cargo build
-
Build the project using Cargo:
cargo build --release
-
Run the executable:
./target/release/process_hollowing.exe