🧠 Process Proxy

📌 Overview

This project injects a payload into a process so it can read and write memory for us,
so you can work with memory without opening or duplicating new handles.

Usage:

• load the payload with proxy::init()
• read and write with proxy::write(address, new value) and proxy::read(address)

In the example, im looking for svchost.exe, in order to read and write values of counter-strike 2

⚙️ Workflow

1. Enable debug privileges
2. Find a process that already has a handle to the target
3. Locate where that handle is stored in memory
4. Allocate memory in the target process
5. Inject payload + shellcode
6. Communicate with the payload to read/write memory

---

proxy::init

int proxy::init(ULONG accessMask, LPCSTR windowName, bool debug)

Main entry point. Executes the full chain.

Parameters

• accessMask: the permissions we are looking for
• windowName: the window the handle should point to
• debug: true or false, depending on whether we want to see what the program is doing

Returns

• 1 → success
• 2 → failed enabling SeDebugPrivilege
• 3 → failed finding process with handle
• 4 → failed finding handle address
• 5 → failed allocating memory
• 6 → failed injecting payload

---

proxy::enableSeDebugPrivilege

bool proxy::enableSeDebugPrivilege()

Enables SeDebugPrivilege to allow interaction with external processes.

---

proxy::findProcessWithHandle

int proxy::findProcessWithHandle(
    ULONG accessMask,
    LPCSTR windowName,
    DWORD* processPIDBuffer,
    HANDLE* duplicatedHandleBuffer,
    USHORT* originalHandleValue
)

Finds a process that already has a handle to the target window.

Parameters

• accessMask: set the permissions you are looking for
• windowName: "Counter - Strike 2"
• processPIDBuffer: pointer to a DWORD that will receive the PID of the process holding the handle
• duplicatedHandleBuffer: pointer to a HANDLE that will receive the duplicated handle (optional)
• originalHandleValue: pointer to a USHORT that will receive the original handle value

---

proxy::findAddressWithHandle

int proxy::findAddressWithHandle(
    HANDLE handle,
    DWORD pid,
    uintptr_t* foundAtAddress,
    LPCSTR windowName
)

Searches inside the process memory to find where the handle is stored.

Parameters

• handle: the handle we are looking for
• pid: the PID of the process where we are searching
• foundAtAddress: pointer to a uintptr_t that will contain the address where the handle is stored
• windowName: the window the handle should point to

---

proxy::prepareCodeInjection

int proxy::prepareCodeInjection(
    DWORD pid,
    LPVOID* rShellCodeBaseAddress,
    LPVOID* wShellCodeBaseAddress,
    LPVOID* rBufferBaseAddress,
    LPVOID* wBufferBaseAddress,
    LPVOID* structBaseAddress
)

Allocates memory in the target process.

Parameters

• pid: PID of the target process that has the handle
• rShellCodeBaseAddress: pointer that will receive the base address where read shellcode is allocated
• wShellCodeBaseAddress: pointer that will receive the base address where write shellcode is allocated
• rBufferBaseAddress: pointer that will receive the base address where read values are stored
• wBufferBaseAddress: pointer that will receive the base address where values to write are stored
• structBaseAddress: pointer that will receive the base address where the payload struct is stored

Allocations

---

payload::load

int payload::load(
    DWORD pid,
    uintptr_t readShellCodeBaseAddress,
    uintptr_t handleAddress,
    uintptr_t readBufferAddress,
    uintptr_t structBaseAddress
)

Injects the payload into the target process.

Parameters

• pid: PID of the target process that has the handle
• readShellCodeBaseAddress: address where the shellcode was allocated
• handleAddress: address where the process stores the desired handle
• readBufferAddress: address where read values are stored
• structBaseAddress: address where the payload struct was allocated

---

📝 Notes

• Uses undocumented NT APIs (NtQuerySystemInformation)
• Needs SeDebugPrivilege
• Assumes target window exists

---

⚠️ Warnings

• Do not use on software you don’t own or don’t have permission to analyze

---