ProcessHypnosis

Process Hypnosis in Rust

Process Hypnosis is an advanced code injection technique that manipulates a target process's execution flow by acting as its debugger. Unlike traditional methods like CreateRemoteThread or Process Hollowing, it avoids suspicious API calls and memory allocation patterns, making it harder for security solutions to detect. Inspired by Carlos Garrido's research, this technique "hypnotizes" a process by freezing it during initialization, modifies its memory, and resumes execution with malicious code.

PoC Image

Implementation Methods

1. Debugger Attachment
   Create a target process (e.g., notepad.exe) with the DEBUG_ONLY_THIS_PROCESS flag using CreateProcessW. This freezes the process until debug events are handled.

2. Event Monitoring
   Use WaitForDebugEvent to capture critical events:

   • CREATE_PROCESS_DEBUG_EVENT: Extract the main thread's start address.
   • LOAD_DLL_DEBUG_EVENT: Enumerate loaded modules without GetModuleHandle.

3. Shellcode Injection
   Overwrite the main thread's entry point (lpStartAddress) with malicious shellcode via WriteProcessMemory. The debugger automatically bypasses memory protection checks.

4. Detach & Execute
   Call DebugActiveProcessStop to unfreeze the process. Execution resumes at the modified entry point, triggering the shellcode.

Some Features

• No Suspicious APIs
  Avoids VirtualAllocEx, CreateRemoteThread, and ResumeThread – common EDR/AV detection vectors.
• No Memory Allocation
  Directly hijacks the existing thread's entry point instead of allocating new memory regions.
• Debugger-Powered Stealth
  Leverages legitimate debugging mechanisms to evade IAT/Inline hooks.
• Symbol Resolution
  Uses SymFromName (instead of GetProcAddress) to resolve function addresses like NtProtectVirtualMemory.

References

1. Carlos Garrido's Original Research
2. Control Flow Hijacking Defense Survey

Author: @5mukx

Hypnotize processes, not people. ~ 5mukx