toneillcodes-windows-process-injection/snippets

Snippets

Index

• bintoc.rb: Ruby to convert a raw binary file to C array style shellcode by 0xNinjaCyclone
• bintoc.py: Python to convert a raw binary file to C array style shellcode (ported from 0xNinjaCyclone's Ruby script)
• bintocsharp.py: Python to convert a raw binary file to C# array style shellcode
• getpid.cpp: FindPidByName implementation and example
• syscallhunter.cpp
• syscalls.asm

Useful PowerShell

Finding Microsoft Edge

Get-CimInstance Win32_Process -Filter "Name = 'msedge.exe' AND CommandLine LIKE '%msedge.exe%'" | 
    Where-Object { $_.CommandLine -notlike '*--type=*' } |
    Select-Object ProcessId, CommandLine | 
    Format-List

Get-CimInstance Win32_Process -Filter "Name = 'msedge.exe' AND CommandLine LIKE '%msedge.exe%'" | 
    Where-Object { $_.CommandLine -notlike '*--type=*' } |
    Select-Object ProcessId