整理笔记时发现之前留下的资料，抛砖引玉，分享给大家。

常见注入方法OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThreadDLL注入LoadLibrary/LoadLibraryEx
GetProcAddress
SetWindowsHookEx钩子注入APC注入CreateToolhelp32Snapshot
Process32First
Thread32First
Thread32Next
Process32Next
OpenProcess
VirtualAllocEx
WriteProcessMemory
QueueUserAPC/NtQueueApcThread
VirtualFreeEx
CloseHandle异步过程调用中断Atom Bombing注入CreateToolhelp32Snapshot
Thread32First
Thread32Next,
OpenThread
CreateEvent
DuplicateHandle
NtQueueApcThread
QueueUserAPC
GetModuleHandle
GetProcAddress
SetEvent
GetCurrentProcess
SleepEx
WaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
CloseHandle据说可以绕过所有Windows AV查杀机制?ALPC注入NtQuerySystemlnformation
NtDuplicateObject/ZwDuplicateObject
GetCurrentProcess
NtQueryObject
NtClose
RtllnitUnicodeString
NtConnectPort
VirtualAllocEx
WriteProcessMemory
CopyMemory
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
GetMappedFileName,
OpenProcess
CloseHandle
GetSystemlnfoAdvanced/Asynchronous Local Procedure CallLOCKPOSCreateFileMappingW
MapViewOfFile
RtlAllocateHeap
NtCreateSection
NtMapViewOfSection
NtCreateThreadEx与僵尸网络Flokibot使用类似的注入技术Hollowing注入CreateProcess
NtQueryProcesslnformation
ReadProcessMemory
GetModuleHandle
GetProcAddress
ZwUnmapViewOfSection/NtUnmapViewOfSection
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread进程替换和RunPE，见封装工具:RISCyPackerDOPPELGANGINGCreateFileTransacted
WriteFlle
NtCreateSection
RollbackTransaction
NtCreateProcessEx
RtICreateProcessParametersEx
VirtualAllocEx
WriteProcessMemory
NtCreateThreadEx
NtResumeThread类似Hollowing,参考:https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdfREFLECTIVE反射注入CreateFileA
HeapAlloc
OpenProcessToken
OpenProcess
VirtualAlloc
GetProcAddress
LoadRemoteLibraryR/LoadLibrary
HeapFree
CloseHandle也可通过封装ReflectiverLoader实现线程执行劫持RtlAdjustPrivilege
OpenProcess
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CloseHandle
VirtualAllocEx
OpenThread
VirtualFree/VirtualFreeEx
SuspendThread
GetThreadContext
VirtualAlloc
WriteProcessMemory
SetThreadContext
ResumeThread

其实现方法可在github上搜索源码，还有一些常见的方法(如注册表Appinit_DLL, AppCertDlls, IFEO）和不常见的hook方法(如EWMI)，后期再整理...