[invisible_hack2]

hi guys, i've some questions

why is ebx+8? it's eax register in context structure but why? is imagebase in eax register of context struct ? i don't get any documentation about it in internet

here is the code

Code

ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&dwImageBase), 4, NULL);

CONTEXT (winnt.h) - Win32 apps | Microsoft Docs

full source

PE-Crypter/runPE.h at master jozemberi/PE-Crypter GitHub

[gigajew]

Don’t focus on what’s where in the stack, what you need to look at is how the windows loader works when a process is created to get an answer to your question

[invisible_hack2]

Don’t focus on what’s where in the stack, what you need to look at is how the windows loader works when a process is created to get an answer to your question

where could i get that info?

[Rossiya]

Process hollowing is nothing more than replacing another process's image with a different one - it's often used to bypass detection where applicable and mask rogue operations by having them be performed by what would appear to be a legitimate process that's actually been hijacked.

Simple & quick basics:

1. Create the process-to-be-hollowed in a suspended state.
2. Unmap the image of the process for the process-to-be-hollowed.
3. Map the new image to the process-to-be-hollowed.
4. Cleanup.
5. Resume execution for the main thread of the hollowed process.

Cleanup stage includes anything from address relocation to hijacking code execution to the new start address via registers with the thread context.

Furthermore, I'd recommend using system calls for NtCreateUserProcess, NtGetContextThread, NtSetContextThread, NtUnmapViewOfSection, NtReadVirtualMemory, NtWriteVirtualMemory, NtResumeThread, NtClose, etc.

If you decide to use NtCreateUserProcess then reverse-engineer CreateProcessInternalW to get a proper implementation working as NtCreateUserProcess alone is only for native PEs (Windows NT native to clarify).

I recommend you study Windows NT APIs (how they work and what their intended use is, as well as how to use them) as well as the Windows PE File Format before you continue.

[LynxAxe]

2. Unmap the image of the process for the process-to-be-hollowed.

It's better for you to use NtUnmapViewOfSectionEx instead of NtUnmapViewOfSection because these NTDLL Ex* APIs keep getting ignored or forgotten about by Anti-Virus products that are using user-mode hooking.

I've been told that NtUnmapViewOfSection/Ex is destined for doom on some Windows PCs so I would suggest you rock your own emulation of it!

[HFDone]

at the end the compiler translate your code to assembly
to understand it you should look into asm runpe
the importent part is the end when you can see why you need the context struct and how its done via thread
...
invoke GetThreadContext,[_PI.hProcess],CTX
invoke WriteProcessMemory,[_PI.hProcess],dword[CTX.Ebx+8],imagebase,0x4,0
pop eax
add eax,dword[eax+0x3C]
mov eax,dword[eax+0x28]
mov [CTX.Eax],eax ; EntryPoint
invoke SetThreadContext,[_PI.hProcess],CTX
invoke ResumeThread,[_PI.hThread]

[invisible_hack2]

Process hollowing is nothing more than replacing another process's image with a different one - it's often used to bypass detection where applicable and mask rogue operations by having them be performed by what would appear to be a legitimate process that's actually been hijacked.

Simple & quick basics:

1. Create the process-to-be-hollowed in a suspended state.
2. Unmap the image of the process for the process-to-be-hollowed.
3. Map the new image to the process-to-be-hollowed.
4. Cleanup.
5. Resume execution for the main thread of the hollowed process.

Cleanup stage includes anything from address relocation to hijacking code execution to the new start address via registers with the thread context.

Furthermore, I'd recommend using system calls for NtCreateUserProcess, NtGetContextThread, NtSetContextThread, NtUnmapViewOfSection, NtReadVirtualMemory, NtWriteVirtualMemory, NtResumeThread, NtClose, etc.

If you decide to use NtCreateUserProcess then reverse-engineer CreateProcessInternalW to get a proper implementation working as NtCreateUserProcess alone is only for native PEs (Windows NT native to clarify).

I recommend you study Windows NT APIs (how they work and what their intended use is, as well as how to use them) as well as the Windows PE File Format before you continue.

Thank you,it's exactly the kind of answer i was looking for

---

at the end the compiler translate your code to assembly
to understand it you should look into asm runpe
the importent part is the end when you can see why you need the context struct and how its done via thread
...
invoke GetThreadContext,[_PI.hProcess],CTX
invoke WriteProcessMemory,[_PI.hProcess],dword[CTX.Ebx+8],imagebase,0x4,0
pop eax
add eax,dword[eax+0x3C]
mov eax,dword[eax+0x28]
mov [CTX.Eax],eax ; EntryPoint
invoke SetThreadContext,[_PI.hProcess],CTX
invoke ResumeThread,[_PI.hThread]

so basically eax register is where entry point start ?

[HFDone]

WriteProcessMemory function (memoryapi.h) - Win32 apps | Microsoft Docs
lpBaseAddress

A pointer to the base address in the specified process to which data is written. Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for write access, and if it is not accessible, the function fails.

lpBuffer

A pointer to the buffer that contains data to be written in the address space of the specified process.

Ebx+8 ; ImageBase
eax ; EntryPoint

[LynxAxe]

It's better for you to use NtUnmapViewOfSectionEx instead of NtUnmapViewOfSection because these NTDLL Ex* APIs keep getting ignored or forgotten about by Anti-Virus products that are using user-mode hooking.

I've been told that NtUnmapViewOfSection/Ex is destined for doom on some Windows PCs so I would suggest you rock your own emulation of it!

Bear in mind, NtUnmapViewOfSectionEx was only introduced for Windows 8, so make sure you check the version of Windows that is installed on the PC before trying to use it.

Code

NTSYSAPI NTSTATUS NtUnmapViewOfSection(
  HANDLE ProcessHandle,
  PVOID  BaseAddress
);

To ensure compatibility, you should use dynamic address resolving (roll your own better emulation of GetProcAddress with EAT scanning) so you can target one or the other depending on whether NtUnmapViewOfSectionEx is present on the version of Windows that's running.

Another member also suggested using system calls manually and I vouch for this suggestion and would recommend it instead of finding the address of those APIs from NTDLL and using them as-is, I cannot express the importance of this !

[Zephyros]

At the process entry, before code is executed, the ebx register contains the PEB (process environment block)
It contains various important info, but in this case it is used to read and late write the processes image base. (8 is the offset from the start of PEB)
Updating it to the correct value is important if the injected Exe contains resources, else the Windows APIs can't find them.

For more info: x86 - Windows initial execution context - Stack Overflow

[invisible_hack2]

WriteProcessMemory function (memoryapi.h) - Win32 apps | Microsoft Docs
lpBaseAddress

A pointer to the base address in the specified process to which data is written. Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for write access, and if it is not accessible, the function fails.

lpBuffer

A pointer to the buffer that contains data to be written in the address space of the specified process.

Ebx+8 ; ImageBase
eax ; EntryPoint

Good explanation ,now everything is much clearer

---

At the process entry, before code is executed, the ebx register contains the PEB (process environment block)
It contains various important info, but in this case it is used to read and late write the processes image base. (8 is the offset from the start of PEB)
Updating it to the correct value is important if the injected Exe contains resources, else the Windows APIs can't find them.

For more info: x86 - Windows initial execution context - Stack Overflow

Thank you too 🤗 🤗