Laboratory Series
Process Injection Series
PE 01
Local ProcessShellcode
Classic Code Injection — Local Process
Windows API calls to allocate memory in local process, write shellcode to allocated memory, and execute it within the same process context.
Open Lab
PE 02
Remote ThreadCreateRemoteThread
Classic Code Injection — Remote Process
Remote thread injection using OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to execute shellcode inside another process.
Open Lab
PE 03
API ObfuscationStatic Bypass
Classic Code Injection with API Obfuscation
Remote thread injection with API call obfuscation to evade static detection by AV/EDR — demonstrates before/after import table differences.
Open Lab
PE 04
VirtualProtectRWX Bypass
Classic Code Injection — VirtualProtect
Avoid RWX region detection by first allocating RW memory, then changing permissions to RX with VirtualProtect only before shellcode execution.
Open Lab
PE 05
DLLLoadLibrary
Classic DLL Injection
Force a target process (explorer.exe) to load a malicious DLL (panda.dll) by injecting the DLL path into remote process memory and calling LoadLibrary.
Open Lab
PE 06
FilelessReflective
Reflective DLL Injection
Execute code within another process by loading a DLL directly from memory without writing to disk, evading disk-based detection mechanisms.
Open Lab
PE 07
Lagos IslandNTDLL Unhook
Unhook NTDLL.DLL — Lagos Island
Manually load and execute a DLL from disk into memory without registering it in the process module list — commonly used for EDR hook removal.
Open Lab
PE 08
HollowingSuspended
Process Hollowing
Start a legitimate process in suspended state, unmap its memory, replace it with malicious code, and resume — malware executes under a trusted process identity.
Open Lab
PE 09
PE BinarySelf Inject
PE Injection
Inject an entire Portable Executable into another process memory space (targeting explorer.exe) and execute it within the remote process context.
Open Lab
PE 10
WPM MagicRX Region
AddressOfEntryPoint Injection
Leverage AddressOfEntryPoint (RX region) and WriteProcessMemory to change permissions and write shellcode — avoids VirtualAlloc and VirtualProtect API calls entirely.
Open Lab
PE 11
APC QueueThread Context
APC Injection
Execute shellcode in another thread's context using the Windows Asynchronous Procedure Call mechanism for deferred function execution.
Open Lab
PE 12
Early LifecycleAPC
Early Bird Injection
Inject code at the very start of a process lifecycle before initialization completes, exploiting the suspended state for more control and less detection than standard APC.
Open Lab
PE 13
Memory HuntingRWX Bypass
RWX Hunting and Injection
Locate existing RWX memory regions inside a target process and inject shellcode there — no new memory allocation needed, avoiding RWX allocation detections.
Open Lab
PE 14
FilelessPending Delete
Process Ghosting
Create a file, mark it for deletion, map it as a memory section, close the handle (deleting it from disk), then spawn a process from the now-fileless section.
Open Lab
PE 15
Thread HijackContext Swap
Remote Thread Hijacking
Hijack an already-running thread in a remote process by manipulating its context, avoiding the creation of new threads which are more easily detected.
Open Lab
PE 16
Module OverwriteHiding in Plain Sight
Module Stomping
Overwrite sections of a legitimate loaded module with malicious code, avoiding custom or suspicious DLL loads by hiding inside a trusted module.
Open Lab
PE 17
PEB WalkDynamic Resolve
PEB Walk Injection
Traverse the Process Environment Block to locate kernel32.dll and dynamically resolve VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread at runtime.
Open Lab
PE 18
PEB WalkAPI Obfuscation
PEB Walk and APIs Obfuscation
Combine PEB walking with full API call obfuscation for a layered approach that defeats both static import analysis and dynamic behaviour monitoring.
Open Lab
PE 19
NT APIsShared Section
NtCreateSection and NtMapViewOfSection
Create a shared RWX memory section with NtCreateSection, map it into the target process using NtMapViewOfSection, write shellcode and execute.
Open Lab
PE 20
Vulnerable DLLRWX Abuse
Mokingjay
Abuse existing RWX regions inside vulnerable DLLs (msys-2.0.dll) to avoid new RWX memory allocation detections — supports both self-inject and remote inject.
Open Lab
PE 21
Process ForkDirty Vanity
Fork API Injection
Dirty Vanity technique abusing Windows process forking — create a child from the calling process, write shellcode into the forked process and execute it.
Open Lab
PE 22
FibersCooperative Threading
Injection through Fibers
Execute shellcode using Windows fiber cooperative threading — manually switch between fiber execution contexts without spawning a new thread, evading thread-based detections.
Open Lab
PE 23
NT APIsUndocumented
NT API Injection
Remote injection using undocumented ntdll.dll APIs — NtOpenProcess, NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateRemoteThread — bypassing higher-level hooks.
Open Lab
PE 24
Direct SyscallsKernel Transition
Direct Syscalls
Bypass all EDR userland hooks by invoking syscall instructions directly in the stub, transitioning straight to kernel without passing through ntdll.dll.
Open Lab
PE 25
Indirect Syscallsntdll Origin
Indirect Syscalls
Evolution of direct syscalls — redirect execution to the syscall instruction inside ntdll.dll, making the call appear to originate legitimately from ntdll memory space.
Open Lab