Talk Intermediate

Unveiling Process Injection

Review Pending

Session Description

Process injection is a powerful technique often associated with security research, malware analysis, and advanced software development. In this talk, I’ll dive into the mechanics of process injection on Windows, showcasing how developers can harness low-level Windows API (WinAPI) calls in C# to interact with system internals. I’ll introduce my open-source tool—designed to simplify and demonstrate process injection—walking attendees through its architecture, implementation, and real-world applications. With live demos, I’ll illustrate how surprisingly accessible these low-level operations can be using C#, debunking the myth that such techniques require complex C++ or Assembly knowledge. Attendees will leave with a clear understanding of process injection, hands-on insights into WinAPI usage, and an open-source tool they can explore, extend, or adapt for their own projects.

Key Takeaways

Understanding Process Injection: Grasp the fundamentals of process injection, its use cases, and its relevance in security and development.
Leveraging WinAPI in C#: Learn how to effectively use low-level Windows API calls in C# to interact with system processes.
Open-Source Tool Demo: Explore a practical, open-source tool for process injection, including its design and how to use or contribute to it.
Hands-On Insights: Gain actionable knowledge from live demos, showing how to implement and experiment with process injection in a Windows environment.

References

https://github.com/3xpl01tc0d3r/ProcessInjection

Session Categories

FOSS

Speakers

Chirag Savla Senior Cloud Security Engineer | White Knight Labs

Chirag Savla is a cyber security professional with 10+ years of experience. His areas of interest include penetration testing, red teaming, azure and active directory security, and post-exploitation research. For fun, he enjoys creating open-source tools and exploring new attack methodologies in his leisure. Chirag has worked extensively on Azure, Active Directory attacks and defense, and bypassing detection mechanisms. He is the author of multiple open source tools such as Process Injection, Callidus, and others. He has presented at many conferences and local meetups and has trained people in international conferences like Blackhat, BSides Milano, Wild West Hackin’ Fest, HackSpaceCon and VulnCon etc.

https://x.com/chiragsavla94