Process Hollowing Injector (C)

Process Hollowing — Shellcode Injector in C

Clean and documented implementation of the process hollowing for code injection in Windows:

• C source code — CreateProcess(SUSPENDED) → NtUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory → ResumeThread.
• x86/x64 Support — Automatic architecture detection of the target process and ajuste of injection.
• Recommended target processes — Lista of legitimate Windows processes that are good candidates (svchost.exe, RuntimeBroker.exe, etc.).
• Shellcode loader — Function wrapper that accepts shellcode raw as input (compatible with msfvenom, Cobalt Strike, Sliver).
• Compilation — Makefile for MinGW and Visual Studio. Compila a standalone executable without externall dependsncies.

Note: This is the base technique. For EDR evasion, combine with the direct syscall and unhooking pieces from the Evasion category.