+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] Process hollowing in Win 10 (/showthread.php?tid=6080736)
Process hollowing in Win 10 - invisible_hack2 - May 22, 2020
I would like to know if this technique is still valid in windows 10 and if it continues to hide the suspended process since now you can see all the suspended processes in windows 10.
which is a good technique to hide the process apart from process hollowing and injection dll?
thank you
RE: Process hollowing in Win 10 - Sinistros - May 23, 2020
(May 22, 2020 03:48 PM)invisible_hack2 Wrote: I would like to know if this technique is still valid in windows 10 and if it continues to hide the suspended process since now you can see all the suspended processes in windows 10.
which is a good technique to hide the process apart from process hollowing and injection dll?
thank you
Hello, i guess the best dll injection is manual mapping, it is the most hidden technique.
RE: Process hollowing in Win 10 - Chameleon - May 23, 2020
(May 23, 2020 08:42 AM)Sinistros Wrote: Hello, i guess the best dll injection is manual mapping, it is the most hidden technique.
Oh darn, i was just about to say that haha.. good one brother
RE: Process hollowing in Win 10 - Jean-Jacques Rousseau - May 24, 2020
(May 23, 2020 08:42 AM)Sinistros Wrote: Hello, i guess the best dll injection is manual mapping, it is the most hidden technique.
Depends on how youre doing it.
OP: what do you mean by suspended process? It i resumed once mapping is done.
RE: Process hollowing in Win 10 - invisible_hack2 - May 27, 2020
(May 24, 2020 05:56 AM)Supercut Wrote: Depends on how youre doing it.
OP: what do you mean by suspended process? It i resumed once mapping is done.
Correct, it's resumed, i'm not tested this technique yet, i don't know if it works in win 10
RE: Process hollowing in Win 10 - Jean-Jacques Rousseau - May 27, 2020
(May 27, 2020 11:26 AM)invisible_hack2 Wrote: Correct, it's resumed, i'm not tested this technique yet, i don't know if it works in win 10
Of course it works. It is unpatchable.
RE: Process hollowing in Win 10 - Zanthir - May 27, 2020
Ive tested it works fine !
RE: Process hollowing in Win 10 - SIM-3466371 - Jun 19, 2020
(May 22, 2020 03:48 PM)invisible_hack2 Wrote: I would like to know if this technique is still valid in windows 10 and if it continues to hide the suspended process since now you can see all the suspended processes in windows 10.
which is a good technique to hide the process apart from process hollowing and injection dll?
thank you
Yes, it's still working in all windows versions.
Because this technique uses api calls and it's not a vulnerability.
If you have equal or more privileges than target process, why not??
Most AV will detect it, specially api calls like Get/setThreadContext, createremotethread, WriteMemory