I'm learning process hollowing on Windows with those materials:
www[.]ired[.]team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations
github[.]com/m0n0ph1/Process-Hollowing/blob/master/sourcecode/ProcessHollowing/ProcessHollowing.cpp
* www[.]autosectools[.]com/process-hollowing.pdf
I realized that a hollowed process with different subsystem it used to be throws 0xc0000142. For example, svchost.exe (IMAGE_SUBSYSTEM_WINDOWS_GUI) crashes because of that when it's substituted with a process with IMAGE_SUBSYSTEM_WINDOWS_CUI. While cmd.exe (IMAGE_SUBSYSTEM_WINDOWS_CUI) doesn't because I guess the subsystem matches.
Is there any way to hollow a process that has different subsystem to the substituted one?
Or do you think there's another reason but the difference of subsystem?
www[.]ired[.]team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations
github[.]com/m0n0ph1/Process-Hollowing/blob/master/sourcecode/ProcessHollowing/ProcessHollowing.cpp
* www[.]autosectools[.]com/process-hollowing.pdf
I realized that a hollowed process with different subsystem it used to be throws 0xc0000142. For example, svchost.exe (IMAGE_SUBSYSTEM_WINDOWS_GUI) crashes because of that when it's substituted with a process with IMAGE_SUBSYSTEM_WINDOWS_CUI. While cmd.exe (IMAGE_SUBSYSTEM_WINDOWS_CUI) doesn't because I guess the subsystem matches.
Is there any way to hollow a process that has different subsystem to the substituted one?
Or do you think there's another reason but the difference of subsystem?