+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] Windows Process Injection Toolkit (/showthread.php?tid=5866786)
Windows Process Injection Toolkit - n00bmk - Jul 27, 2018
So, I decided to make my own multi-injection kit which will utilize every concievable method of process injection.
Its purely coded in C#, but may be widened to C/C++ in the future if needed for more generic methods...
Anyways, here it is: https: // github.com /m4mm0n/WinPIT
And as always, please do make issue reports if bugs are found - I know the last added injector is buggy and unstable...
Also, everything gets logged - check the sources ;)
RE: Windows Process Injection Toolkit - NTW5B - Jul 27, 2018
(Jul 27, 2018 04:16 AM)n00bmk Wrote: So, I decided to make my own multi-injection kit which will utilize every concievable method of process injection.
Its purely coded in C#, but may be widened to C/C++ in the future if needed for more generic methods...
Anyways, here it is: https: // github.com /m4mm0n/WinPIT
And as always, please do make issue reports if bugs are found - I know the last added injector is buggy and unstable...
Also, everything gets logged - check the sources ;)
Could you please add a ReplacePE?? ( Replace Process )
This is one of the Best thing's I've seen online...
In C/C++, use C for Stability
For the C/C++, Don't use LoadLibrary/ProcAdress to hide imports, The stub will get flagged as a packer EVERYWHERE
Search: 50c863f238d8328804d7e96e583cf1d2c707419184937ae68cb038a71f8bc568
On hybrid-analysis and It gets flagged as "kryptor 6" while on YODAS PROTECTOR, I only checked "Hide Imports"
it uses LoadLibrary/ProcAdress
Plus, Some of those stuff aren't needed, but No matter what, FALCON/Cylance will detect anything
Just use C/C++ antis and You'll be done..
RE: Windows Process Injection Toolkit - HFDone - Jul 29, 2018
"Credits are due where credits are due, no greets and no regrets!"
Add Credit https://github.com/Washi1337/AsmResolver
dont know why you using it
your ManualMap is just for 64bit
https://github.com/vmcall/loadlibrayy/blob/master/Injection/ManualMap.cs ?= https://github.com/m4mm0n/WinPIT/blob/master/Injectors.ManualMap/Injector.cs
...
RE: Windows Process Injection Toolkit - Washi - Jul 29, 2018
Great that someone is using my library!
However, I kindly ask you to obey the license terms that I set for using it. AsmResolver is released under the LGPLv3 license, which essentially means that you are free to use it anywhere, so long you include the original copyright and license notices of the library, as well as a reference to the original source, and state any changes that you have made to the library.
For more information, read:
https://github.com/Washi1337/AsmResolver/blob/master/LICENSE.md
Or use the TL;DR for an easy to read list of all conditions that you should obey.
https://tldrlegal.com/license/gnu-lesser-general-public-license-v3-(lgpl-3)
RE: Windows Process Injection Toolkit - n00bmk - Jul 29, 2018
Apologiez, honestly thought I had added you to the credits - but will be fixed :)