Introducing the Threatblogger Process Injector, a custom C/C++ security tool I designed and built from scratch to facilitate the reliable execution of 64-bit shellcode within a remote target process.

I originally engineered this program as a dedicated testing framework. When writing or modifying 64-bit assembly payloads, verifying their stability and execution flow inside memory can be incredibly tedious. I built this injector to bridge that gap—providing a streamlined, programmatic environment to test custom 64-bit shellcode examples, analyze how they interact with system resources, and definitively verify whether they work as intended in a live environment.

How It Works

The architecture follows a precise, low-level operational workflow utilizing the Windows API:

  • Process Targeting & Handle Acquisition: The program accepts a user-specified PID or process name, using OpenProcess to request a valid handle with the necessary access rights.
  • Remote Memory Allocation: It dynamically provisions a memory region inside the target process space using VirtualAllocEx, configuring the page protections to accommodate execution.
  • Payload Writing: The raw 64-bit shellcode is safely written into the newly allocated remote memory buffer via WriteProcessMemory.
  • Execution Execution: Finally, the tool triggers execution of the payload by spawning a new execution path inside the remote host, traditionally leveraging CreateRemoteThread.

By handling the intricate nuances of x64 memory alignment and thread management, this injector serves as a reliable benchmark tool for offensive security research, payload development, and defense verification.

Link to Github Repository: Link