bynanex/kernelmode-manual-mapping-through-iat

Manual mapping without creating any threads, with rw only access

Manual mapping x64 without creating any threads

Instead of using CreateRemoteThread or typical thread hijacking methods(e.g. GetThreadContext), this mapper injects into code flow through import table. Address of function is overwritten with stub address, it is later restored after calling the stub. It supports interacting with the process by handle or kernel driver. Injecting with a driver allows you to execute code inside protected processes.

Usage:

mmap mapper(INJECTION_TYPE::KERNEL); // or INJECTION_TYPE::USERMODE

if (!mapper.attach_to_process("example_process.exe"))
	return 1;

if (!mapper.load_dll("example_dll.dll"))
	return 1;

if (!mapper.inject())
	return 1;

Credits

• teosek //usermode_proc class, import walking
• Daquas //testing