Process Hollowing Injector (C)
$119.99
Process Hollowing (RunPE) — Win32/NT API Injector
Single-file C implementation of process hollowing. Creates a suspended target, unmaps its image, maps the payload and redirects the thread context to the payload entry point.
- Injection chain: CreateProcessW(CREATE_SUSPENDED) -> NtUnmapViewOfSection -> VirtualAllocEx -> WriteProcessMemory (PE headers + sections, RVA-to-file-offset resolved manually) -> PEB.ImageBaseAddress fix-up -> SetThreadContext (RIP/Eax) -> ResumeThread.
- v1.4 demo payload fixed: the built-in MessageBox shellcode patches its caption/title pointers at runtime (v1.3 referenced unpatched [rip+0] slots); emulated end-to-end on x86 and x64.
- Architecture guard: payload PE Machine field is checked against the injector build before mapping.
- Memory hardening: section protections transition RWX to RX after the payload is written.
- No dependencies: Win32 + ntdll only (NtUnmapViewOfSection); builds with MinGW-w64 or MSVC.
- Prebuilt demo binaries included: hollow32.exe / hollow64.exe. Usage: hollow.exe [target] [payload.bin] — compatible with msfvenom, Cobalt Strike and Sliver raw output.
Escalation path: pair with direct syscalls and unhooking primitives for EDR evasion.
Key Features
- Single-file C implementation of Process Hollowing (RunPE): suspended process, image unmap, payload map, thread redirect
- Working demo payload: MessageBox shellcode with runtime pointer patching (was broken in v1.3)
- Architecture guard: payload machine must match the injector build
- Section protection RWX -> RX after payload write
- Targets: svchost.exe, RuntimeBroker.exe, dllhost.exe, WerFault.exe and similar
- No external dependencies beyond Win32/NT API (ntdll only)
Requirements
- Windows 10/11 x64 or x86 target
- MinGW-w64 or MSVC to compile (instructions in README)
- Payload as raw shellcode (demo included)
Changelog
- 1.4 (2026-10-19): fixed broken demo payload (real runtime patching), added architecture guard, RWX->RX protection, README rebuilt; verified by emulation on x86+x64
- 1.3 (2025-03-15): initial store release
Package Contents
Exact contents of the download archive (4 files):
| hollow32.exe | 260,406 B |
| README.md | 1,574 B |
| process_hollowing.c | 18,541 B |
| hollow64.exe | 278,584 B |
Related Tools
Malware Development
Reflective DLL Injection Template
Malware Development
Python RAT Core Module
Malware Development
Shellcode Encoder x86/x64
Malware Development