DEF CON 32 - Process Injection Attacks w ROP - Bramwell Brizendine, Shiva Shashank Kusuma

[BLUF] The video presents a novel return-oriented programming (ROP) methodology for process injection on Windows, using ROP chains to dynamically enumerate processes, inject shellcode, and execute it in external processes—without relying on traditional exploit techniques or custom malware. 1:48

Key Takeaways:
• The speaker introduces a robust ROP framework with over 150 unique patterns for Windows APIs and native calls, enabling flexible and reusable process injection techniques 4:57.
• A custom enumerating process function is built via raw assembly in writable memory, using ROP to iterate through processes and identify a target by string match (e.g., "VPlayer") 13:00.
• The ROP chain leverages pushad and movd references to build structures, manage memory, and retrieve critical values like PID and process handles, enabling precise targeting 14:44.
• Shellcode is injected into a target process using process memory APIs, with page permissions changed via virtual protect to allow execution 19:31.
• The complete ROP chain includes 29 gadgets, combining Windows APIs (e.g., LoadLibrary, CreateToolhelp32Snapshot, CreateRemoteThread) to achieve full injection and execution 9:24.

This work provides a scalable, reusable methodology for ROP-based process injection, emphasizing practicality and extensibility over brute-force techniques. 22:38

Sources:

• 1:48 Overview of ROP-based process injection methodology and goals
• 4:57 Presentation of over 150 unique ROP patterns fo