{"schemaVersion":"1.0","type":"Article","types":["Article"],"slug":"50-types-of-terminal-process-injection-principles-and-source-code-jbplc","url":"https://zyvop.com/50-types-of-terminal-process-injection-principles-and-source-code-jbplc","title":"50 Types of Terminal Process Injection: Principles and Source Code","subtitle":null,"tldr":"introduction: I am engaged in collecting various process injection principles and source codes. Collect these personal learning needs and automation needs in mu...","keywords":[],"entities":["I0veD","cyber security researcher","ZyVOP"],"keyTakeaways":["introduction: I am engaged in collecting various process injection principles and source codes.","Collect these personal learning needs and automation needs in multiple environments.","If compiled using pure C++ binary aggregation, the file size is only 3mb."],"headings":[],"outboundLinks":["https://mp.weixin.qq.com/s/mp_FcnPpvTEFPQ4LvBSE-A"],"contentText":"introduction: I am engaged in collecting various process injection principles and source codes. Collect these personal learning needs and automation needs in multiple environments. If compiled using pure C++ binary aggregation, the file size is only 3mb. Technical nameCompletion progressLink (empty represents common items, available on Baidu)CreateRemoteThread Shellcode InjectionCompletedDLL InjectionCompletedReflective DLL InjectionCompletedShellcode Reflective DLL InjectionCompletedProcess DoppelgangingCompletedLoading and Executing Shellcode From PE ResourcesCompletedProcess Hollowing and Portable Executable RelocationsCompletedAPC Queue Code InjectionCompletedEarly Bird APC Queue Code InjectionCompletedShellcode Execution in a Local Process with QueueUserAPC and NtTestAlertCompletedShellcode Execution through FibersCompletedShellcode Execution via CreateThreadpoolWaitCompletedLocal Shellcode Execution without Windows APIsCompletedInjecting to Remote Process via Thread HijackingCompletedv0.0.5SetWindowHookEx Code InjectionCompletedFinding Kernel32 Base and Function Addresses in ShellcodeCompletedExecuting Shellcode with Inline Assembly in C/C++CompletedWriting Custom Shellcode Encoders and DecodersCompletedBackdooring PE Files with ShellcodeCompletedNtCreateSection + NtMapViewOfSection Code InjectionCompletedAddressOfEntryPoint Code Injection without VirtualAllocEx RWXCompletedModule Stomping for Shellcode InjectionCompletedPE Injection: Executing PEs inside Remote ProcessesCompletedAPI Monitoring and Hooking for Offensive ToolingCompletedWindows API HookingCompletedImport Adress Table (IAT) HookingCompletedDLL Injection via a Custom .NET Garbage CollectorCompletedWriting and Compiling Shellcode in CCompletedBelongs to pre-development optionsInjecting .NET Assembly to an Unmanaged ProcessCompletedBinary ExploitationCompletedpool partyCompletedA pool party you will never forget: using the new process injection technology of Windows thread pool - Prophet Community (aliyun.com) blackhatTLS callback injectCompletedThread Local Storage of Process Injection - commonly used in malware anti-debugging, detecting whether there is a debugger before OEP and then exiting the program - bonelee - Blog Park (cnblogs.com)ListPlantingCompletedProcess injection of ListPlanting - abusing the message callback function of the listview control - bonelee - Blog Garden (cnblogs.com)Extra Window MemoryCompletedProcess injection: Extra Window Memory (extra window memory) injection - using user-defined data to inject malicious code - bonelee - Blog Park (cnblogs.com)Asynchronous Procedure CallCompletedhttps://www.cnblogs.com/bonelee/p/17705390.htmlTransacted HollowingCompletedPersonal projects ALL in ONEProcess OverwritingCompletedAnother use of Process Hollowing - Process Overwriting-DecoyMini Technical Exchange Community - Powered by Discuz! (decoyit.com)loacal API x 13CompletedAdded 13 new localAPIs. For details, please see my previous blog article vt full anti-kill loader - CD_blog (cdxiaodong.github.io)pagetableinjectCompletedkkent030315/PageTableInjection: Code injection, injecting malicious payload via pagetables pml4. (github.com)threadlessCompletedNew remote injection method-Threadless injection (qq.com)Plug-in: Main thread hookCompletedJust put your own logic in the game main loop or send and receive packets and run something. You can only hook a new thread.Cross-session activation mechanism remotely calls com to achieve process injectionCompletedCICADA8-Research/IHxExec: Process Injection Alternative (github.com)ROP process injectionCompletedBw3ll/ROP_ROCKET: ROP ROCKET is an advanced code reuse attack framework with extensive ROP chain generation capabilities, including novel Windows Syscalls attacks, novel Heaven's Gate, and \"shellless\" ROPs. The framework leverages emulation and obfuscation to help expand the attack surface. --- Bw3ll/ROP_ROCKET: ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Syscalls attack, a novel Heaven's Gate, and \"shellcodeless\" ROP. The framework utilizes emulation and obfuscation to help expand the attack surface. (github.com)setwindowshook injection requires that the corresponding program does not open CFGNot completedhttps://mp.weixin.qq.com/s/mp_FcnPpvTEFPQ4LvBSE-AIt is not impossible to detect it at all. If EDR collects window data source, or has nucleation or infinityhook like xxx, it will be very easy to detect.Fortunately, win32k data source, hypervisor, and infinityhook have become the infrastructure components of most security software..So it is not difficult to detect. Take EDR for example, its detection results are exactly the same as those of the previous APT, because EDR collected the win32k data sourceFrostLock injectionNot completedFrostLock injection is a freeze/thaw-based code injection technique that uses a Windows job object to temporarily freeze (suspend) a target process, inject shellcode, and then seamlessly resume (thaw) the process.‣Indirect-Shellcode-ExecutorNot completedIndirect-Shellcode-Executor exploits a configuration error/vulnerability in the API Windows method ReadProcessMemory discovered by DarkCoderSc. It exploits a feature of the input/output pointer parameter called *lpNumberOfBytesRead, which perfectly allows an attacker to write to process memory without calling common API methods such as memcpy.‣","contentHash":"sha256:85f1d943a62909163375ef21eaf173570475be2aa648d6bc583e41c918fa265a","authorName":"I0veD","authorUrl":"https://zyvop.com/author/i0ved","authorSameAs":["https://www.cdxiaodong.life/","https://github.com/cdxiaodong","https://www.linkedin.com/in/%E6%A0%8B-%E7%A8%8B-167b89391/"],"category":null,"tags":[],"audience":"Technical professionals and readers researching software development","tone":"Professional, cyber security researcher perspective","readingTimeMinutes":3,"wordCount":644,"faqs":null,"primaryTopic":null,"publishedAt":"2026-08-12T05:39:35.306Z","updatedAt":"2026-09-01T17:20:00.127Z","canonicalUrl":"https://www.cdxiaodong.life/article/2a60f0c5-b87c-8095-92df-eb1fb180b488"}