(Mar 2, 2025 05:13 AM)Lowkey Wrote:  Do you have the project files or any specific line item code errors you are receiving?

Wouldn't mind taking a look with/for you to see if I can help!

(Mar 2, 2025 05:25 AM)Lowkey Wrote:  Alright so

For 0x00000005 (Permission Issues)
- You might need to run your program as administrator since you're modifying memory, injecting into a process, and using VirtualAllocEx and WriteProcessMemory functions.

For 0x00000141 (Issues with DLL Loading)
- If kernel32.dll or ntdll.dll fails to load properly, LoadLibrary may return an invalid handle.
- So basically make sure that the DLLs are present and accessible.
- Instead of storing kernel32Handle and ntdllHandle as static members, try calling LoadLibrary in LoadFunctions() to ensure they are properly loaded.

You also have an incorrect function delegate(s)

The CreateProcessDelegate is incorrect:

It should be

CreateProcessA uses STARTUPINFO and PROCESS_INFORMATION, not byte arrays.

The function signature must match exactly.

(Mar 2, 2025 05:35 AM)Incog Wrote:  The issue is due to the new windows update (11 24H2)

Classic runPE uses MEM_PRIVATE instead of normal processes using MEM_IMAGE
https://windowsforum.com/threads/windows-11-24h2-breaking-process-hollowing-and-malware-defense.351197/

https://github.com/hasherezade/transacted_hollowing

Here is an example of a runPE that circumvents this, you can also patch ntdll however that can lead to issues with stability.

(Mar 2, 2025 10:31 PM)boomboom99 Wrote:  Amazing how crypt services are only now starting to understand what started happening 3 months ago. Just shows you the quality of the crypts that are sold here.

There is a much easier way to bypass it without needing to change any "runpe" original code.. but of course you expect people to just give you the solution.
Open a debugger.. Use your brain. Where does the Hotpatch check comes from? Protip: Not in kernel. So you can simply remove it.

(Mar 3, 2025 01:14 AM)Phantom_Services Wrote:  You know my Crypt works perfectly on win11 with the Update, because i dont use process hollowing :)

But thanks, will take a look

(Mar 3, 2025 04:04 AM)boomboom99 Wrote:  First of all the issue is not only "Process hollowing" But merely anyone who "Allocates" MEMORY in a remote suspended process.

If you are so good, why open a thread? You can't open a debugger? Find the issue yourself? Or is your only way of fixing things is by being spoon fed with information? Is that only way you know?
People forgot how to use their brain.

People who are good, don't need to open a thread begging for information. Minimum you could of done is google searching... You didn't even do the minimum.

But okay "Mr CRYPTER 1337"

(Mar 4, 2025 12:14 AM)ServersFxcked Wrote:  Mate his in a forum for god sake his allowed to ask hahah, damn we got Fun Police over here

(Mar 4, 2025 12:14 AM)ServersFxcked Wrote:  Mate his in a forum for god sake his allowed to ask hahah, damn we got Fun Police over here

(Mar 4, 2025 01:19 AM)boomboom99 Wrote:  It is just funny to me that a CRYPT owner that demands 100$ a crypt asks a question that he can answers himself with a debugger in under 2 minutes. Shows you the quality of the crypters that are sold here.
Copy pasted garbage.

(Mar 2, 2025 04:42 AM)Phantom_Services Wrote:  Hello everyone,

I recently discovered some old process hollowing code that I developed a few years ago. I tested it, but it no longer works. I also checked on GitHub and encountered the same issue. Does anyone know what exactly has changed in Windows or why it doesn't work anymore?

(Mar 4, 2025 06:01 AM)loomixx Wrote:  If you have this issue on Win11 24H2, you have to patch RtlpInsertOrRemoveScpCfgFunctionTable function (ntdll.dll) with this:
const BYTE Patch[4] =
{
0x48, 0x31, 0xC0, // xor rax, rax
0xC3 // ret
};

(Mar 4, 2025 10:01 AM)boomboom99 Wrote:  RtlpInsertOrRemoveScpCfgFunctionTable IS not exported so this comment is useless.

(Mar 4, 2025 11:00 AM)loomixx Wrote:  wdym lol