Add example to README

README.md

@@ -16,3 +16,30 @@ The VS solution itself supports 4 build configurations which map to 4 different
 
 The goal of each technique is to successfully capture code execution while proxying functionality to the legitimate DLL. Each technique is tested to ensure static and dynamic sink situations are handled. This is by far not every primitive or technique variation. The post above goes into more detail.
 
+## Example
+
+Prepare a hijack scenario with an obviously incorrect DLL
+```
+> copy C:\windows\system32\whoami.exe .\whoami.exe
+        1 file(s) copied.
+
+> copy C:\windows\system32\kernel32.dll .\wkscli.dll
+        1 file(s) copied.
+
+```
+
+Executing in the current configuration should result in an error
+```
+> whoami.exe 
+
+"Entry Point Not Found"
+```
+
+Convert kernel32 to proxy functionality for wkscli
+```
+> NetClone.exe --target C:\windows\system32\kernel32.dll --reference C:\windows\system32\wkscli.dll --output wkscli.dll
+[+] Done.
+
+> whoami.exe
+COMPUTER\User
+```