FunctionStomping: new shellcode injection technique

FunctionStomping

This is a brand-new technique for shellcode injection to evade AVs and EDRs. This technique is inspired by Module Stomping and has some similarities. As to this date (23-01-2022) also hollows-hunter doesn’t find it.

The big advantage of this technique is that it isn’t overwriting an entire module or pe, just one function, and the target process can still use any other function from the target module.

The disadvantage is that it won’t work for every function in the wild (but it will work for most of them), the exact explanation will be in my blog (COMING SOON).

Download

git clone https://github.com/Idov31/FunctionStomping.git

Use

You either include the header to your program like this:

#include "functionstomping.hpp"



int main() {

    // Just get the pid in any way and pass it to the function.

    DWORD pid = 3110;

    FunctionStomping(pid);

    return 0;

}

Or use the rust program (COMING SOON):

cd functionstomping
cargo b
functionstomping.exe <pid>