3xpl01tc0d3r/ProcessInjection

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1259 stars · 191 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A C# command-line tool that demonstrates and performs multiple Windows process injection techniques, including DLL injection, process hollowing, APC queue, and KernelCallbackTable injection. It supports shellcode in several formats, multiple invocation methods (P/Invoke, D/Invoke, direct and indirect syscalls), and evasion features like parent PID spoofing and XOR/AES shellcode encryption.

Use cases

• inject shellcode into a remote process on windows
• perform process hollowing for red team exercises
• test EDR detection of process injection techniques
• execute shellcode with direct syscalls to evade hooks
• demonstrate DLL injection and APC queue injection
• encrypt shellcode with AES or XOR before injection

When to choose

• you need a single tool covering many process injection techniques
• you want to compare P/Invoke, D/Invoke, and syscall-based injection
• you are doing red team tooling or security research on Windows

When to avoid

• you need a defensive detection tool rather than an offensive one
• you target non-Windows platforms
• you want a maintained production-grade framework rather than a demonstration tool

Facets

cli-tool · maturity active

security penetration-testing cli security penetration-testing windows windows cli dotnet process-injection shellcode offensive-security red-team defense-evasion syscalls d-invoke

Member repositories

For agents

markdown · JSON · MCP: product_card(name="3xpl01tc0d3r/ProcessInjection")