jxy-s/herpaderping

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1210 stars · 224 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A proof-of-concept tool and technical write-up demonstrating Process Herpaderping, a Windows technique that maps a process image from a file and then rewrites the file on disk before the initial thread runs. This causes security products that inspect the file at process-creation callbacks or IRP_MJ_CLEANUP to attribute the running process to the wrong binary.

Use cases

• bypass antivirus inspection of newly created processes
• study how Windows kernel process-creation callbacks can be evaded
• demonstrate write-map-modify-execute-close evasion of on-write scanning
• compare herpaderping with process hollowing and doppelganging
• research security product detection gaps on Windows 7 through Windows 10

When to choose

• you are a security researcher or red-teamer studying Windows process-creation evasion techniques
• you need a working reference implementation of Process Herpaderping with a detailed technical explanation
• you want to test or harden EDR/antivirus inspection at PsSetCreateProcessNotifyRoutineEx and IRP_MJ_CLEANUP

When to avoid

• you need a general-purpose process launcher or legitimate application tooling
• you are looking for a cross-platform or non-Windows technique
• you want a maintained production tool rather than a research proof of concept

Facets

cli-tool · maturity active

security penetration-testing reverse-engineering security windows penetration-testing reverse-engineering windows cpp process-herpaderping antivirus-evasion process-hollowing process-doppelganging exploit-development defense-evasion red-team malware-technique kernel-callback-bypass proof-of-concept

Member repositories

For agents

markdown · JSON · MCP: product_card(name="jxy-s/herpaderping")