Injection Techniques
Injection Techniques
The first positional argument to main.py selects the injection technique. Techniques fall into three groups:
- Local — run shellcode in the current process (e.g.
current_thread). - Remote — place shellcode inside another target process (take
-p/--process). - Userland — reach the shellcode via userland API callbacks instead of a raw thread.
Technique membership is defined in payloadfactory/constants/payload_constants.py.
Windows techniques
The code distinguishes two subsets explicitly — REMOTE_INJECTIONS (need a target process) and USERLAND_INJECTIONS (use API callbacks). Everything else behaves as a local/current-process injector.
| Category | Techniques |
|---|---|
| Local (other) | current_thread, current_hell, map_view, hybrid, self_inject, enum_monitors, unhook_ntdll, process_ghosting, peb_walk, mockingjay, dirty_vanity, ssdt_hijack |
| Remote | process_hollow, queue_apc, remote_thread, remote_thread_suspended, module_stomping, early_bird_apc, thread_hijack, remote_map_view, transacted_hollow, entrypoint_injection, rwx_hunting, classic_dll_injection, reflective_dll, pe_injection |
| Userland | fiber, callback_enum_windows, timer_queue, callback_cert_enum, api_obfuscation |
There are 31 Windows techniques in total (PayloadConstants.SUPPORTED_INJECTIONS).
Remote techniques and target process
Remote techniques name the target via -p/--process (default explorer.exe). Short names are auto-expanded to full Windows paths:
| Short name | Resolved path |
|---|---|
msedge.exe | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe |
iexplore.exe | C:\Program Files\Internet Explorer\iexplore.exe |
mpcmdrun.exe | C:\Program Files\Windows Defender\MpCmdRun.exe |
lsass.exe | C:\Windows\System32\lsass.exe |
svchost.exe | C:\Windows\System32\svchost.exe |
python main.py process_hollow -s sc.bin -p lsass.exe -o lsass_hollow.exe
Linux techniques
When --os linux is set, the factory validates the technique against PayloadConstants.LINUX_INJECTIONS instead of the Windows list — so Windows-only techniques are rejected and vice-versa.
| Category | Techniques |
|---|---|
| Remote | ptrace_inject, process_vm_writev |
| Userland | mmap_jit, signal_handler, dlopen_memfd, mprotect_shellcode |
| Local | memfd_exec |
There are 7 Linux techniques. Remote ones take -p/--process (e.g. bash). See Linux targets for details.
Choosing a technique
current_thread— simplest local injector; creates a new thread in the current process.process_hollow/transacted_hollow— replace a suspended target's image; classic for bypassing process integrity checks.fiber/timer_queue/callback_enum_windows— userland callback injection, harder for some EDRs to attribute to a remote thread.ssdt_hijack— hook a System Service Descriptor Table entry to execute shellcode from another process's context.