 toneillcodes
|
5f1eee7e62
|
Updates to blast-radius and dump-exports. Adding profiling scripts and notes.
|
2026-06-08 08:12:57 -04:00 |
|
|
toneillcodes
|
f61053bb0d
|
PoC process profiler scripts
|
2026-06-05 15:46:28 -04:00 |
|
|
toneillcodes
|
6f27bda513
|
Initial commit of API monitoring and dormant code comparison scripts
|
2026-06-04 17:18:27 -04:00 |
|
|
toneillcodes
|
c7107a39eb
|
Fixing static function usage in PEB resolution. Adding process profiling.
|
2026-06-04 09:35:13 -04:00 |
|
|
toneillcodes
|
25576abde4
|
Adding module sniping helpers for parsing exports and assessing blast radius
|
2026-06-02 12:28:26 -04:00 |
|
|
toneillcodes
|
aaad5cad95
|
Adding command line arguments for the target module and function
|
2026-06-02 11:53:00 -04:00 |
|
|
toneillcodes
|
6399772b3b
|
Various fixes and enhancements to module stomping and snippet code
|
2026-06-02 08:58:55 -04:00 |
|
|
toneillcodes
|
7cef058dea
|
Adding pauses to easily follow the stomping process in a debugger
|
2026-05-31 13:14:08 -04:00 |
|
|
toneillcodes
|
8c842d5c5f
|
Cleaning up references
|
2026-05-29 20:31:21 -04:00 |
|
|
toneillcodes
|
6f737e743c
|
Adding hot patching resources
|
2026-05-29 19:52:05 -04:00 |
|
|
toneillcodes
|
d63b475929
|
Removing unnecessary VirtualProtect API calls from local module stomp example, protection toggling is handled by WriteProcessMemory
|
2026-05-29 16:50:33 -04:00 |
|
|
toneillcodes
|
042487aec2
|
Fixing typos
|
2026-05-29 14:39:38 -04:00 |
|
|
toneillcodes
|
3b3a2a7752
|
Removing oddly specific 'GetExplorerPid' function in favor of 'FindPidByName'.
|
2026-05-25 21:50:13 -04:00 |
|
|
toneillcodes
|
ec116702ed
|
Adding remote module stomping PoC
|
2026-05-25 16:52:57 -04:00 |
|
|
toneillcodes
|
3a414da4f2
|
Refactoring PEB parsing code to streamline processing for local and remote usage.
|
2026-05-24 17:04:43 -04:00 |
|
|
toneillcodes
|
77731d645e
|
Renaming PEB variable that Gemini did a horrendous job with. Refactoring argument parsing.
|
2026-05-22 07:32:46 -04:00 |
|
|
toneillcodes
|
125d8014ef
|
Adding module stomping resources and information
|
2026-05-21 23:00:32 -04:00 |
|
|
toneillcodes
|
d158d4201e
|
Merge branch 'main' of https://github.com/toneillcodes/windows-process-injection
|
2026-05-21 22:45:41 -04:00 |
|
|
toneillcodes
|
a53411978b
|
Parent process ID spoofing and header adjustments
|
2026-05-21 22:45:32 -04:00 |
|
|
toneillcodes
|
cd5c4772d8
|
Update find-stompable-dlls.py with full path output, and include/exclude list filtering
|
2026-05-21 19:37:57 -04:00 |
|
|
toneillcodes
|
face33a5cf
|
Update README.md with find-stompable-dlls script info
|
2026-05-18 22:09:28 -04:00 |
|
|
toneillcodes
|
6d1d26fbd5
|
Create find-stompable-dlls.py
|
2026-05-18 22:06:34 -04:00 |
|
|
toneillcodes
|
bc8566f98e
|
Addd tlhelp32 header to utils.h
|
2026-05-01 08:57:51 -04:00 |
|
|
toneillcodes
|
f5e38b1b39
|
Add GetExplorerPID to utils.h
|
2026-05-01 08:57:16 -04:00 |
|
|
toneillcodes
|
99efbd098f
|
Add GetExplorerPID to utils.cpp
|
2026-05-01 08:56:46 -04:00 |
|
|
toneillcodes
|
9fd17692a4
|
Update indirect-syscalls-ex.cpp
|
2026-04-30 22:15:47 -04:00 |
|
|
toneillcodes
|
388473e0d1
|
Create indirect-syscalls.asm
|
2026-04-30 21:45:33 -04:00 |
|
|
toneillcodes
|
b3c5923408
|
Create indirect-syscalls-ex.cpp
|
2026-04-30 21:45:08 -04:00 |
|
|
toneillcodes
|
e316669669
|
Initial commit of alphabet-peb-loader PoC
|
2026-04-07 18:19:22 -04:00 |
|
|
toneillcodes
|
9e073fc830
|
Fixing the manual ordinal resolution
|
2026-04-07 14:34:56 -04:00 |
|
|
toneillcodes
|
d717869c63
|
Adjusting function names to maintain obfuscation
|
2026-04-07 11:03:12 -04:00 |
|
|
toneillcodes
|
1ab7be871d
|
Fixing PEB includes and README links
|
2026-04-04 15:35:19 -04:00 |
|
|
toneillcodes
|
b8e9e0f5b3
|
Merge branch 'main' of https://github.com/toneillcodes/windows-process-injection
|
2026-04-04 12:04:04 -04:00 |
|
|
toneillcodes
|
7fd776ecfa
|
Updating PEB/EAT code, adding syscall examples and snippets
|
2026-04-04 12:03:40 -04:00 |
|
|
toneillcodes
|
01266bdb97
|
Create bintocsharp.py
|
2026-03-10 19:46:40 -04:00 |
|
|
toneillcodes
|
ef0fea33c9
|
PEB walking and EAT crawling
|
2026-01-22 22:11:08 -05:00 |
|
|
toneillcodes
|
486d9bcc89
|
Adding module stomping. Fixing VirtualAlloc call in example 2, adding stub folders for additional techniques.
|
2026-01-22 08:43:44 -05:00 |
|
|
toneillcodes
|
b88bef461a
|
Create getpid.cpp
|
2025-09-05 19:06:46 -04:00 |
|
|
toneillcodes
|
aea57a2099
|
Port bintoc from ruby to python
|
2025-09-01 21:04:24 -04:00 |
|
|
toneillcodes
|
e9c4a8d6e6
|
Create bintoc.rb
|
2025-09-01 19:20:16 -04:00 |
|
|
toneillcodes
|
81d13a98cf
|
Styling fix to FindPidByName function name
|
2025-08-25 17:54:32 -04:00 |
|
|
toneillcodes
|
0172ac99ec
|
Style update
|
2025-08-17 18:16:13 -04:00 |
|
|
toneillcodes
|
0125033d0b
|
Adding links to code references
|
2025-08-17 18:12:45 -04:00 |
|
|
toneillcodes
|
ac755de068
|
Update README.md
|
2025-08-17 18:11:46 -04:00 |
|
|
toneillcodes
|
408d3b32ae
|
Update injection-example-2.cpp
|
2025-08-17 18:08:58 -04:00 |
|
|
toneillcodes
|
1b38162c27
|
Update injection-example-1.cpp
|
2025-08-17 18:08:30 -04:00 |
|
|
toneillcodes
|
82d6123e7c
|
Rename injection-example-4.cpp to fundamentals/injection-example-4.cpp
|
2025-08-17 18:04:58 -04:00 |
|
|
toneillcodes
|
b0e70239c0
|
Rename injection-example-3.cpp to fundamentals/injection-example-3.cpp
|
2025-08-17 18:04:43 -04:00 |
|
|
toneillcodes
|
25da772dd6
|
Rename injection-example-2.cpp to fundamentals/injection-example-2.cpp
|
2025-08-17 18:04:23 -04:00 |
|
|
toneillcodes
|
7b6103501d
|
Rename injection-example-1.cpp to fundamentals/injection-example-1.cpp
|
2025-08-17 18:04:01 -04:00 |
|