Run a Exe File (PE Module) in memory (like an Application Loader)

Process Hollowing in C++ (x86 / x64) - Process PE image replacement

ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption

Loader and RunPE file executer

An implementation of the Process Hollowing technique.

RunPE dump - I wrote this to have better control over the analysis of malwares. I can stop and analysis malware when it uses some of the API's i hook and to dump the memory while it is using RunPE/PH techniques.

Executing EXE Files From Memory

C++ application that uses memory and code hooks to detect packers

Implementation of the Process Hollowing technique for process injection (This is the second of three methods in the series)

Implementation of the Process Hollowing technique for process injection (This is the first of three methods in the series)

Implementation of the Process Hollowing technique for process injection (This is the third of three methods in the series)