admin/toneillcodes-windows-process-injection
1
0
Fork 0
mirror of https://github.com/toneillcodes/windows-process-injection synced 2026-06-21 14:11:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md with find-stompable-dlls script info

Browse Source
This commit is contained in:
toneillcodes
2026-05-18 22:09:28 -04:00
committed by GitHub
parent 6d1d26fbd5
commit face33a5cf
1 changed files with 42 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module-stomping/README.md
+42 -1
View File
@@ -9,6 +9,47 @@ Module Stomping is a process injection technique where a legitimate, image-backe
| **Tactical Goal** | **Evade Memory Scanners:** Bypasses detections that flag `RX` memory regions not backed by a file on disk (`MEM_PRIVATE`). |
| **Stealth** | **Moderate.** While it solves the "unbacked memory" problem, it introduces another IoC "Module Mismatch" (the memory content no longer matches the file on disk). |
## DLL Scanner
[find-stompable-dlls.py](find-stompable-dlls.py)
```
PS C:\Users\Administrator\Desktop\Tools > python .\find-stompable-dlls.py 0x80000
[*] Scanning Target Directory: 'C:\Windows\System32'
[*] Filtering for Files : > 1.0MB
[*] Required .text Space : 0x80000 bytes
------------------------------------------------------------------------------------------
DLL Name | File Size (MB) | Size of .text | Virtual Address
------------------------------------------------------------------------------------------
aadtb.dll | 1.48 | 0xff60c | 0x1000
ActiveSyncProvider.dll | 1.73 | 0x14abe2 | 0x1000
aeinv.dll | 1.60 | 0x13495a | 0x1000
aemarebackup.dll | 1.23 | 0xf8a64 | 0x1000
aepic.dll | 1.25 | 0xf2afa | 0x1000
APMon.dll | 1.57 | 0xe395c | 0x1000
appraiser.dll | 3.18 | 0x26b133 | 0x1000
AppVEntSubsystemController.dll | 1.22 | 0xc941c | 0x1000
AppVEntSubsystems64.dll | 1.63 | 0x10565c | 0x1000
AppVEntVirtualization.dll | 1.56 | 0x108d1c | 0x1000
AppVIntegration.dll | 1.37 | 0xd648c | 0x1000
AppXDeploymentClient.dll | 1.45 | 0xe89d0 | 0x1000
AppXDeploymentExtensions.desktop.dll | 2.68 | 0x1ab07c | 0x1000
AppXDeploymentExtensions.onecore.dll | 3.44 | 0x23493c | 0x1000
...
PrintConfig.dll | 3.66 | 0x1c497c | 0x1000
PS5UI.DLL | 1.19 | 0xa993c | 0x1000
UNIDRVUI.DLL | 1.27 | 0xb840c | 0x1000
cimwin32.dll | 1.75 | 0x12f3dc | 0x1000
DMWmiBridgeProv.dll | 3.75 | 0x244a1c | 0x1000
Microsoft.Uev.AgentWmi.dll | 1.09 | 0xc3d6c | 0x1000
NetPeerDistCim.dll | 1.39 | 0xffe3a | 0x1000
wbemcore.dll | 1.77 | 0xee98c | 0x1000
Microsoft.Windows.Appx.PackageManager.Commands.Core.dll | 2.68 | 0x2acd98 | 0x2000
AuthFWSnapIn.Resources.dll | 2.98 | 0x2f9674 | 0x2000
Microsoft.Windows.ServerManager.Plugins.Ipam.resources.dll | 2.72 | 0x2b6d04 | 0x2000
------------------------------------------------------------------------------------------
[*] Found 433 potential candidates.
PS C:\Users\Administrator\Desktop\Tools >
```
## Execution Steps
The `local-stomp.cpp` example follows this execution logic:
@@ -37,4 +78,4 @@ The use of `VirtualProtect` on an image-backed region is a high-confidence heuri
## Indicators of Compromise (IoC)
* **Memory/Disk Mismatch:** Significant byte differences between the loaded module and its corresponding `C:\Windows\System32\` file.
* **Suspicious Call Trace:** Thread execution starting from the middle of a DLL's code section rather than a legitimate exported function.
* **API Pattern:** The sequence of `LoadLibrary` -> `VirtualProtect(RW)` -> `VirtualProtect(RX)` is a classic signature of memory manipulation.
* **API Pattern:** The sequence of `LoadLibrary` -> `VirtualProtect(RW)` -> `VirtualProtect(RX)` is a classic signature of memory manipulation.