[Abducted]

Hey,

Do any of you have any experience with or know any good references to resources where I could learn more about C++ injections to running processes? Or malware development resources in general?

[Shisho]

At the moment I think process hollowing and process doppelganging are the de-facto injection methods involving trusted process hijacks. The latter also introduces a locking system in the form of NTFS transactions which makes the memory unreadable until the transaction is complete which will roll itself back and make it look like nothing ever happened in the first place.

A quick Google search can find you numerous PE loaders written to load arbitrary code into 32-bit or 64-bit processes. rohitab seems to have a lot of capable malware programmers that release their code for free and is a good place to find some examples to analyze.

[ModernJS]

Is this process injection also possible on linux with elf binaries?

[Shisho]

Is this process injection also possible on linux with elf binaries?

On Linux you could likely just fork, exec, SIGSTOP and then replace the memory of the new process and then inject your shellcode or ELF file and then rebuild the import tables and addresses to mimic process hollowing.

[ModernJS]

On Linux you could likely just fork, exec, SIGSTOP and then replace the memory of the new process and then inject your shellcode or ELF file and then rebuild the import tables and addresses to mimic process hollowing.

Yup you're right

https://security.stackexchange.com/quest...unix-macos

[3DES]

Google has all the information in the world.