# 3xpl01tc0d3r/ProcessInjection

This program is designed to demonstrate various process injection techniques

Repository: https://github.com/3xpl01tc0d3r/ProcessInjection
Canonical: https://ross.abutalabs.com/products/processinjection
Language: C#
License: GPL-3.0
License Family: copyleft
Last push: 2025-08-07T19:46:49+00:00

## Health v2 (maintenance only)
Score: 48/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 35, release rhythm 35, longevity 100
- inputs: {"age_days": 2559, "days_push": 391, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1259, forks 191 (observed 2026-08-28T04:04:09.897280+00:00)

## What it is
A C# command-line tool that demonstrates and performs multiple Windows process injection techniques, including DLL injection, process hollowing, APC queue, and KernelCallbackTable injection. It supports shellcode in several formats, multiple invocation methods (P/Invoke, D/Invoke, direct and indirect syscalls), and evasion features like parent PID spoofing and XOR/AES shellcode encryption.

## Use cases
- inject shellcode into a remote process on windows
- perform process hollowing for red team exercises
- test EDR detection of process injection techniques
- execute shellcode with direct syscalls to evade hooks
- demonstrate DLL injection and APC queue injection
- encrypt shellcode with AES or XOR before injection

## When to choose
- you need a single tool covering many process injection techniques
- you want to compare P/Invoke, D/Invoke, and syscall-based injection
- you are doing red team tooling or security research on Windows

## When to avoid
- you need a defensive detection tool rather than an offensive one
- you target non-Windows platforms
- you want a maintained production-grade framework rather than a demonstration tool

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, cli
- domain: security, penetration-testing, windows
- platform: windows, cli, dotnet
- tags: process-injection, shellcode, offensive-security, red-team, defense-evasion, syscalls, d-invoke

## Member repositories
- 3xpl01tc0d3r/ProcessInjection (main) score 48

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:09.897280+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:04:26.113506+00:00, confidence not recorded.
  - readme: https://github.com/3xpl01tc0d3r/ProcessInjection (fetched 2026-08-28T04:04:09.897280+00:00, sha 925ccf91f157)
- Data as of 2026-08-30T08:39:29.467469+00:00.