+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: [Help] Hollowing a process on Windows with different subsystem; Is that possible? (/showthread.php?tid=6239094)
Hollowing a process on Windows with different subsystem; Is that possible? - mylah - Apr 15, 2023
I'm learning process hollowing on Windows with those materials:
www[.]ired[.]team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations
github[.]com/m0n0ph1/Process-Hollowing/blob/master/sourcecode/ProcessHollowing/ProcessHollowing.cpp
* www[.]autosectools[.]com/process-hollowing.pdf
I realized that a hollowed process with different subsystem it used to be throws 0xc0000142. For example, svchost.exe (IMAGE_SUBSYSTEM_WINDOWS_GUI) crashes because of that when it's substituted with a process with IMAGE_SUBSYSTEM_WINDOWS_CUI. While cmd.exe (IMAGE_SUBSYSTEM_WINDOWS_CUI) doesn't because I guess the subsystem matches.
Is there any way to hollow a process that has different subsystem to the substituted one?
Or do you think there's another reason but the difference of subsystem?