[Phantom_Services]

Hello everyone,

I recently discovered some old process hollowing code that I developed a few years ago. I tested it, but it no longer works. I also checked on GitHub and encountered the same issue. Does anyone know what exactly has changed in Windows or why it doesn't work anymore?

[Phantom_Services]

Do you have the project files or any specific line item code errors you are receiving?

Wouldn't mind taking a look with/for you to see if I can help!

Tested on win11 btw.

0x0000004
0x0000005
0x0000141

these mostly. on every script i tested.

Here is a .Net runpe x64 where i get the error:

https://paste.ee/p/0gLeYNv7

[Phantom_Services]

Alright so

For 0x00000005 (Permission Issues)
- You might need to run your program as administrator since you're modifying memory, injecting into a process, and using VirtualAllocEx and WriteProcessMemory functions.

For 0x00000141 (Issues with DLL Loading)
- If kernel32.dll or ntdll.dll fails to load properly, LoadLibrary may return an invalid handle.
- So basically make sure that the DLLs are present and accessible.
- Instead of storing kernel32Handle and ntdllHandle as static members, try calling LoadLibrary in LoadFunctions() to ensure they are properly loaded.

You also have an incorrect function delegate(s)

The CreateProcessDelegate is incorrect:

It should be

CreateProcessA uses STARTUPINFO and PROCESS_INFORMATION, not byte arrays.

The function signature must match exactly.

Thanks will check that

[Phantom_Services]

The issue is due to the new windows update (11 24H2)

Classic runPE uses MEM_PRIVATE instead of normal processes using MEM_IMAGE
https://windowsforum.com/threads/windows...se.351197/

https://github.com/hasherezade/transacted_hollowing

Here is an example of a runPE that circumvents this, you can also patch ntdll however that can lead to issues with stability.

Uff, is there another good alternative?

[boomboom99]

Amazing how crypt services are only now starting to understand what started happening 3 months ago. Just shows you the quality of the crypts that are sold here.

There is a much easier way to bypass it without needing to change any "runpe" original code.. but of course you expect people to just give you the solution.
Open a debugger.. Use your brain. Where does the Hotpatch check comes from? Protip: Not in kernel. So you can simply remove it.

[Phantom_Services]

Amazing how crypt services are only now starting to understand what started happening 3 months ago. Just shows you the quality of the crypts that are sold here.

There is a much easier way to bypass it without needing to change any "runpe" original code.. but of course you expect people to just give you the solution.
Open a debugger.. Use your brain. Where does the Hotpatch check comes from? Protip: Not in kernel. So you can simply remove it.

You know my Crypt works perfectly on win11 with the Update, because i dont use process hollowing :)

But thanks, will take a look

[boomboom99]

You know my Crypt works perfectly on win11 with the Update, because i dont use process hollowing :)

But thanks, will take a look

First of all the issue is not only "Process hollowing" But merely anyone who "Allocates" MEMORY in a remote suspended process.

If you are so good, why open a thread? You can't open a debugger? Find the issue yourself? Or is your only way of fixing things is by being spoon fed with information? Is that only way you know?
People forgot how to use their brain.

People who are good, don't need to open a thread begging for information. Minimum you could of done is google searching... You didn't even do the minimum.

But okay "Mr CRYPTER 1337"

[ServersFxcked]

First of all the issue is not only "Process hollowing" But merely anyone who "Allocates" MEMORY in a remote suspended process.

If you are so good, why open a thread? You can't open a debugger? Find the issue yourself? Or is your only way of fixing things is by being spoon fed with information? Is that only way you know?
People forgot how to use their brain.

People who are good, don't need to open a thread begging for information. Minimum you could of done is google searching... You didn't even do the minimum.

But okay "Mr CRYPTER 1337"

Mate his in a forum for god sake his allowed to ask hahah, damn we got Fun Police over here

[Phantom_Services]

Mate his in a forum for god sake his allowed to ask hahah, damn we got Fun Police over here

Fr

[boomboom99]

Mate his in a forum for god sake his allowed to ask hahah, damn we got Fun Police over here

It is just funny to me that a CRYPT owner that demands 100$ a crypt asks a question that he can answers himself with a debugger in under 2 minutes. Shows you the quality of the crypters that are sold here.
Copy pasted garbage.

[Phantom_Services]

It is just funny to me that a CRYPT owner that demands 100$ a crypt asks a question that he can answers himself with a debugger in under 2 minutes. Shows you the quality of the crypters that are sold here.
Copy pasted garbage.

When i would copy paste stuff, i wouldnt have 0-2 Detections Runtime :)) Just use Loadpe for a long time now and was interested what microsoft did. When you have a problem with me asking questions, ignore them. Thank you

[loomixx]

Hello everyone,

I recently discovered some old process hollowing code that I developed a few years ago. I tested it, but it no longer works. I also checked on GitHub and encountered the same issue. Does anyone know what exactly has changed in Windows or why it doesn't work anymore?

If you have this issue on Win11 24H2, you have to patch RtlpInsertOrRemoveScpCfgFunctionTable function (ntdll.dll) with this:
const BYTE Patch[4] =
{
0x48, 0x31, 0xC0, // xor rax, rax
0xC3 // ret
};

[boomboom99]

If you have this issue on Win11 24H2, you have to patch RtlpInsertOrRemoveScpCfgFunctionTable function (ntdll.dll) with this:
const BYTE Patch[4] =
{
0x48, 0x31, 0xC0, // xor rax, rax
0xC3 // ret
};

RtlpInsertOrRemoveScpCfgFunctionTable IS not exported so this comment is useless.

[loomixx]

RtlpInsertOrRemoveScpCfgFunctionTable IS not exported so this comment is useless.

wdym lol

[boomboom99]

wdym lol

It means u can't find it by walking the export table like you can find any normal NT function because it is not exported.
So it is not a reliable way.