This is my "lil_calc" PoC presented on the video:
Test with ProcessExplorer vs TaskManager
It is not FUD, but it can fool some tools and it can be used as a test case.
The process overwrites it's owm PEB to create an illusion, that it has been loaded from a different path.
Currently, 32bit version works on 32bit systems only.
forked from hasherezade/process_chameleon
-
Notifications
You must be signed in to change notification settings - Fork 0
A process overwriting its own PEB to make an illusion that it has been loaded from a different path.
brownbelt/process_chameleon
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
About
A process overwriting its own PEB to make an illusion that it has been loaded from a different path.
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published
Languages
- C 94.1%
- C++ 5.5%
- CMake 0.4%