Puppet process three-step shelling

Puppet Process creation Process:

(1) Create a process in create_suspended mode by CreateProcess.

(2) GetThreadContext Gets the suspend process context.

(3) Zwunmapviewofsection unloading suspend process memory space data;

(4) VirtualAlloc allocating memory space;

(5) WriteProcessMemory writes malicious code to allocated memory;

(6) SetThreadContext set the status of the suspend process;

(6) ResumeThread Wakeup process Run

1.ZwResumeThread set breakpoints.

When the parent process writes data to the puppet process and sets the thread context, it calls the Zwresumethread wake-up thread to run.

2.Dump Puppet Process

When the zwresumethread is broken, use the Pchunter dump puppet process.

Right--View--View process memory

Click Dump to save as EXE file.

3. Correcting section Information

LOADPE Load Dump program, view section information

After correction

Done, perfect operation ~

Puppet process three-step shelling