This is a brand-new technique for shellcode injection to evade AVs and EDRs. This technique is inspired by Module Stomping and has some similarities. As to this date (23-01-2022) also hollows-hunter doesn't find it.
The big advantage of this technique is that it isn't overwritting an entire module or pe, just one function and the target process can still use any other function from the target module.
The disadvantage is that it won't work for every function in the wild (but it will work for most of them), the exact explanation is in my blog: The Good, The Bad And The Stomped Function.
You either include the header to your program like this:
#include"functionstomping.hpp"intmain() {
// Just get the pid in any way and pass it to the function.DWORD pid = 3110;
FunctionStomping(pid);
return0;
}Or use the rust program:
cd functionstomping
cargo b
functionstomping.exe <pid>- Turn the rust implementation to library.
- Change the shellcode limit
Currently, the shellcode to run is just to pop a calculator, but all you need to do is replace the unsigned char shellcode[] with your shellcode. I used C++ 17 and VS2019 to compile the program with the C++ header and rust version 2021 to compile the rust program (you can see the dependencies in the Cargo.toml).
I'm not responsible in any way for any kind of damage that is done to your computer / program as cause of this project. I'm happily accept contribution, make a pull request and I will review it!
If you found someone that published about this method before today (23-01-2022) please let me know so I can add an acknowledgment.
https://github.com/countercept/ModuleStomping
https://www.cyberark.com/resources/threat-research-blog/masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners