Process Injection Techniques - Gotta Catch Them All
summary
A comprehensive catalog claims to enumerate nearly all Windows 10 x64 medium->medium integrity no privilege elevation process injection methods, breaking each into memory-allocation, memory-writing and execution primitives and testing >20 execution variants. Only four execution styles are CFG-agnostic: thread hijack (suspend/setcontext/resume), ghost-writing, callback override, and the new stack‑bombing. A memset+memmove APC write method and atom‑bomb/section‑map writers are demonstrated; an open‑source injector on GitHub implements the techniques and shows working demos (message box payloads, Explorer tests).
AI-written summary · about
chapters (19)
- 0:00Welcome and logistics
- 0:37Introduction to injection
- 2:14Defining true injection
- 3:24Windows 10 security impact
- 6:17Injection research scope
- 9:36Classic injection methods
- 11:23Classic DLL injection
- 13:53APC execution technique
- 16:25Thread hijacking and ROP
- 18:41Ghost writing technique
- 22:29Shared memory techniques
- 24:15Atom bombing techniques
- 27:03DLL mapping and rewriting
- 29:36Callback override techniques
- 33:43New techniques: Stack bombing
- 37:47Summary of techniques
- 39:09Inject library overview
- 41:20Demonstrations
- 47:21Q&A and conclusion
related talks
35mThe Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
50mWrite Once, Pwn Anywhere
27mDetecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries
51mThe Anatomy of an Exploit
51mPrompt Injection: When Hackers Befriend Your AI
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)
01h 06mHacking C# from the inside
57mThe Anatomy of an Exploit