____                                    __  __      ____              _             
          / __ \_________  ________  __________   / / / /___  / / /___ _      __(_)___  ____ _
         / /_/ / ___/ __ \/ ___/ _ \/ ___/ ___/  / /_/ / __ \/ / / __ \ | /| / / / __ \/ __ `/ 
        / ____/ /  / /_/ / /__/  __(__  |__  )  / __  / /_/ / / / /_/ / |/ |/ / / / / / /_/ /
       /_/   /_/   \____/\___/\___/____/____/  /_/ /_/\____/_/_/\____/|__/|__/_/_/ /_/\__, /
                                                                                     /____/
                                                                                     
                                                                                    
                                 Process Hollowing in C++ (x86 / x64)         
                                    Process PE Image Replacement

📖 Project Overview :

This process hollowing implementation is written in C++, the loader is a x64 executable with can inject into x86 and x64 processes.

The loader make severals checks before trying to inject the new PE image.

• Check if the PE image have a valid signature.
• Check if the target process and the PE image have the same architecture.
• Check if the target process and the PE image have the same subsystem.
• Check if the PE image have a relocation table.

The loader is able to inject PE image with and witout relocation table, if there is no relocation table the loader try to allocate memory at the preferred image base address.

If you don't know how PE format are structured you can look at this project.

🚀 Getting Started :

Warning
This is a x64 executable, you can't compile this project in x86, this loader is made to inject into x86 and x64 processes. You can easily make a x86 process hollowing program based on this repository.

Visual Studio :

1. Open the solution file (.sln).
2. Build the project in Release (x64)

Other IDE using CMAKE :

This CMakeLists.txt should compile the project.

cmake_minimum_required(VERSION 3.0)
project(runpe)

set(CMAKE_CXX_STANDARD 17)

add_executable(runpe Process_Hollowing.cpp)

Tested on CLion with MSVC compiler, you can get Visual Studio Build Tools here.

🧪 Usage :

How to use the program :

Use it in the command line :

runpe.exe <source image> <target process>

Demonstration :

Demo.mp4