From 3b3a2a7752c730ede6e95caf9fb02ae3854acb43 Mon Sep 17 00:00:00 2001
From: toneillcodes <tom.oneill13@gmail.com>
Date: Mon, 25 May 2026 21:50:13 -0400
Subject: [PATCH] Removing oddly specific 'GetExplorerPid' function in favor of
 'FindPidByName'.

---
 includes/utils.cpp                     | 18 +-----------------
 includes/utils.h                       |  1 -
 module-stomping/README.md              | 12 ++++++++++++
 ppid-spoofing/spoof-ppid-earlybird.cpp |  3 ++-
 4 files changed, 15 insertions(+), 19 deletions(-)

diff --git a/includes/utils.cpp b/includes/utils.cpp
index 1d3598d..edf9a15 100644
--- a/includes/utils.cpp
+++ b/includes/utils.cpp
@@ -75,20 +75,4 @@ int my_wcsicmp(const wchar_t* s1, const wchar_t* s2) {
     } while (c1 == c2);
     
     return c1 - c2;
-}
-
-// Helper to find Explorer PID
-DWORD GetExplorerPID() {
-    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
-    PROCESSENTRY32 pe = { sizeof(pe) };
-    if (Process32First(hSnapshot, &pe)) {
-        do {
-            if (lstrcmpiW(pe.szExeFile, L"explorer.exe") == 0) {
-                CloseHandle(hSnapshot);
-                return pe.th32ProcessID;
-            }
-        } while (Process32Next(hSnapshot, &pe));
-    }
-    if (hSnapshot) CloseHandle(hSnapshot);
-    return 0;
-}
+}
\ No newline at end of file
diff --git a/includes/utils.h b/includes/utils.h
index f2a9dd5..0112dfc 100644
--- a/includes/utils.h
+++ b/includes/utils.h
@@ -11,6 +11,5 @@ int my_strlen_for(const char* s);
 int my_strcmp(const char* s1, const char* s2);
 int my_stricmp(const char* s1, const char* s2);
 int my_wcsicmp(const wchar_t* s1, const wchar_t* s2);
-DWORD GetExplorerPID();
 
 #endif 
diff --git a/module-stomping/README.md b/module-stomping/README.md
index 8945ec6..753fd21 100644
--- a/module-stomping/README.md
+++ b/module-stomping/README.md
@@ -242,6 +242,7 @@ c:\Users\Administrator\Desktop\module-stomping>
 ```
 
 ## Execution Steps
+### Stomping in the Current Process
 The `local-stomp.cpp` example follows this execution logic:
 
 1. **Load Target DLL:** Use `LoadLibraryExA` with the `DONT_RESOLVE_DLL_REFERENCES` flag to map a "sacrificial" DLL into the process without executing its entry point.
@@ -250,6 +251,17 @@ The `local-stomp.cpp` example follows this execution logic:
 4. **Write Payload:** Use `WriteProcessMemory` or `RtlCopyMemory` to stomp the payload over the legitimate instructions.
 5. **Reprotect (Execute):** Revert the memory permissions back to Read-Execute (`RX`).
 6. **Execution:** Trigger the shellcode using a thread execution API (e.g., `CreateThread` or `CreateRemoteThread`).
+### Stomping in a Remote Process
+The `remote-stomp.cpp` example follows this execution logic:  
+
+1. **Acquire Process Handle:** Open a handle to the target remote process via OpenProcess using the supplied Process ID (PID) with the required access rights.
+2. **Locate Remote PEB:** Query the target process to find its remote Process Environment Block (PEB) address using internal utility routines.
+3. **Parse Remote Modules:** Walk the remote process's InMemoryOrderModuleList to dynamically locate the base address of a loaded target module (e.g., KERNEL32.dll).
+4. **Identify Section / Export Target:** Verify the boundaries of the executable .text section, and locate a specific target function address (e.g., FileTimeToSystemTime) within that module via manual Export Address Table (EAT) parsing.
+5. **Reprotect (Write):** Call VirtualProtectEx to change the target function's memory permissions in the remote process from Read-Execute (RX) to Read-Write (RW).
+6. **Write Payload:** Use WriteProcessMemory to stomp the shellcode payload directly over the legitimate instructions of the identified remote export.
+7. **Reprotect (Execute):** Revert the remote memory permissions back to Read-Execute (RX) via VirtualProtectEx.
+8. **Execution:** Trigger the payload within the target process context using a remote execution API (e.g., CreateRemoteThread) pointing directly to the stomped function address.
 
 ## OPSEC Considerations
 
diff --git a/ppid-spoofing/spoof-ppid-earlybird.cpp b/ppid-spoofing/spoof-ppid-earlybird.cpp
index a7ec24a..d62b0da 100644
--- a/ppid-spoofing/spoof-ppid-earlybird.cpp
+++ b/ppid-spoofing/spoof-ppid-earlybird.cpp
@@ -2,6 +2,7 @@
 #include <stdio.h>
 
 #include "..\includes\utils.h"              //  crt replacements
+#include "..\includes\ps-utils.h"           //  process functions
 
 int main(int argc, char* argv[]) {
     if (argc < 2) {
@@ -33,7 +34,7 @@ int main(int argc, char* argv[]) {
     PROCESS_INFORMATION pi = { 0 };
     SIZE_T attributeSize = 0;
 
-    DWORD parentPid = GetExplorerPID();
+    DWORD parentPid = FindPidByName(L"explorer.exe");
     if (parentPid == 0) return -1;
 
     HANDLE hParent = OpenProcess(PROCESS_CREATE_PROCESS, FALSE, parentPid);