> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/red-team/dev/code-injection/process-hollowing.md).

# Process Hollowing

## Hollow with Shellcode

* <https://github.com/chvancooten/OSEP-Code-Snippets/blob/main/Shellcode%20Process%20Hollowing/Program.cs>
* <https://github.com/S3cur3Th1sSh1t/Creds/blob/master/Csharp/DinvokeProcessHollow.cs>

1\. Create the target process (e. g., `svchost.exe`) in a suspended state.

![](/files/-Mefs9YRV8KZ-_xztvMw)

2\. Query created process to extract its base address pointer from PEB (**P**rocess **E**nvironment **B**lock).

![](/files/-Mefs9YSkPsyiRA7g6HA)

3\. Read 8 bytes of memory (for 64-bit architecture) pointed by the image base address *pointer* in order to get the actual value of the image base address.

![](/files/-Mefs9YTHKKU0oxSs1d7)

4\. Read 0x200 bytes of the loaded EXE image and parse PE structure to get the EntryPoint address.

![](/files/-Mefs9YU4u_4A6tC53oK)

5\. Write the shellcode to the EntryPoint address and resume thread execution.

![](/files/-Mefs9YVwGGUDlQjwgzf)

## Hollow with EXE

* <https://github.com/m0n0ph1/Process-Hollowing>
* <https://gist.github.com/gnh1201/6a3836468c898f7ad3a3656e6f24dce3>
* <https://www.ired.team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations>