suvllian/process-inject
Free在Windows环境下的进程注入方法：远程线程注入、创建进程挂起注入、反射注入、APCInject、SetWindowHookEX注入
FreeFree tier
About suvllian/process-inject
A comprehensive collection of process injection techniques for Windows environments, implemented in C/C++. Covers remote thread injection, suspended process injection, APC injection (both Ring0 and Ring3), reflective DLL injection, SetWindowHookEX injection, suspend thread injection, and registry injection. Each method is provided with source code and detailed explanations. Developed and tested on Windows with Visual Studio 2015 for both 32-bit and 64-bit systems.
Key Features
Multiple injection techniques: remote thread, suspend process, APC (user & kernel mode), reflective, SetWindowHookEX, suspend thread, and registry injection
Source code provided for each method in C/C++
Tested on both 32-bit and 64-bit Windows systems
Includes driver-level APC injection (Ring0)
Detailed explanations of injection principles and PE file manipulation
Modular project structure with separate folders per technique
Pros & Cons
Pros
- Comprehensive coverage of major injection methods in one repository
- Well-documented with both code and theoretical explanations in Chinese
- Includes both user-mode and kernel-mode (Ring0) APC injection
- Modular structure makes it easy to study each technique independently
- Tested on 32-bit and 64-bit Windows platforms
Cons
- Documentation is primarily in Chinese, limiting non-Chinese readers
- No active maintenance or releases since creation
- Requires Visual Studio 2015 and Windows environment to compile and run
- Some methods (e.g., registry injection) are marked as untested
Best For
Educational learning of Windows process injection fundamentalsSecurity research and penetration testingDeveloping software patches by injecting code into running processesUnderstanding DLL injection and shellcode techniques
FAQ
What injection methods are covered in this repository?
The repository covers remote thread injection, suspended process injection, APC injection (both Ring0 and Ring3), reflective DLL injection, SetWindowHookEX injection, suspend thread injection, and registry injection.
Is this project actively maintained?
The repository shows no recent commits or releases, indicating it is not actively maintained. It serves as a reference collection.
What development environment is required?
Windows operating system with Visual Studio 2015. The code has been tested on both 32-bit and 64-bit Windows systems.
Are there any limitations?
Some methods like registry injection are marked as untested. The project is primarily for educational and research purposes.