handle-hijacker

KO | EN

gitlite — search

#javascript #hacktoberfest #react #typescript #golang #go #machine-learning #rust #macos #java #windows #awesome-list #ios #open-source

handle-hijacker

(★ 9)

Windows process injection via handle hijacking

handle-hijacker Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Handle Hijacking Loader

A research project implementing handle hijacking injection techniques for Windows process manipulation.

## Background

The technique is well-established: traditional DLL injection (CreateRemoteThread) is immediately detected because every step is a known signature. But system processes like svchost constantly get handles to other processes for legitimate reasons. This project demonstrates how to leverage those existing process handles to avoid detection signatures.

This implementation has been tested on various applications to validate the approach.

Through analyzing VAC internals, VAC primarily inspects handles *created* to the process. Handles that *already exist* (inherited, legitimately obtained by system processes) are not the focus of inspection. This is why handle hijacking works in CS2 and other VAC-protected games - VAC watches for new suspicious OpenProcess calls and direct injection signatures, but doesn't flag reuse of existing handles by system processes. Related research projects: [cs2-vac-internals](https://github.com/Aspasia1337/cs2-vac-internals) and [VAC-ModuleDumper](https://github.com/Aspasia1337/VAC-ModuleDumper).

## What is Handle Hijacking?

In Windows, a **handle** is basically a key to a resource. If svchost.exe already has an open handle to a target process (for legitimate system reasons), why create a new one?

**The core idea**: 
- Don't open the target yourself (obvious)
- Find an intermediate process that already has a handle to your target
- Hijack a thread in that intermediate process
- Use its existing handle to inject code

**The difference that matters**:
- ✗ Handle Duplication = copying a handle from one process to another
- ✓ Handle Hijacking = reusing a handle that already exists

## How Handle Hijacking Works (--proxy mode)

This is what `--proxy` actually does:

1. **Scan for handles** - Search through system processes (svchost, explorer, dwm) to find one with an open handle to your target
2. **Open the intermediate** - Get memory access to that system process (NOT directly to the target)
3. **Find a safe thread** - Locate a sleeping thread in the intermediate process that you can safely hijack
4. **Redirect execution** - Change where that thread is about to execute (modify RIP)
5. **Use the existing handle** - The hijacked thread now uses the handle that was *already open* in that process
6. **Result** - Your code runs in the target process, but the injection appears to come from a trusted system process

**The key difference**: kernel logging shows "svchost accessed target" (normal system behavior) instead of "loader.exe accessed target" (suspicious injection attempt).

This is why it works in VAC-protected games - VAC doesn't intercept operations using pre-existing handles the same way it does new OpenProcess calls.

### Demo

Here's the loader successfully injecting into CS2 using proxy mode:

![Loader Demo - CS2 Injection](https://raw.githubusercontent.com/Aspasia1337/handle-hijacker/main/images/loader-demo.png)

The command window shows the loader finding CS2, discovering an intermediate process with an existing handle, hijacking a thread, and successfully executing the injection—all while maintaining the appearance that the operations came from a legitimate system process.

## Building It

You need:
- Windows 10/11
- Visual Studio 2022
- Windows SDK

```bash
msbuild loader.vcxproj /p:Configuration=Release /p:Platform=x64
```

## Using It

```bash
# Direct injection (reference/education only - gets caught immediately)
loader.exe target.exe payload.dll

# Handle Hijacking (--proxy mode - the actual technique)
loader.exe --proxy target.exe payload.dll

# Works with any target process
loader.exe --proxy explorer.exe payload.dll
loader.exe --proxy notepad.exe payload.dll
loader.exe --proxy any_app.exe payload.dll
```

**Important**: The `--proxy` mode is the actual handle hijacking implementation. This is the technique that matters.

It finds an intermediate process (usually svchost, explorer, or dwm) that already has an open handle to your target, hijacks one of its threads, and executes the injection code in that thread's context using the pre-existing handle.

The direct mode (without `--proxy`) is included only for comparison and educational purposes. It's the obvious approach that anti-cheat systems immediately detect. Use `--proxy`.

## The Code

**loader.cpp** - Entry point. Handles argument parsing and dispatches to either direct or proxy mode.

**inject.cpp** - Standard CreateRemoteThread injection. Included for comparison but gets detected immediately.

**proxy_inject.cpp** - The interesting part. This is where the actual handle hijacking happens:
- Finds intermediate process with existing handle
- Hijacks its thread
- Executes ProxyWorker in its context
- ProxyWorker uses the existing handle to inject into the target

The code is heavily commented explaining what's happening at each step and why.

## Implementation Details

### Handle Discovery
Iterate through running processes, open them with PROCESS_DUP_HANDLE access, enumerate their handle tables, and check if any point to the target process. This is how we find which system process to hijack.

### Thread Hijacking
Find a thread that's sleeping in a safe stub (NtDelayExecution, NtWaitForWorkViaWorkerFactory). Suspend it, redirect RIP to our shellcode, resume it. The thread now runs our code while still in the context of the legitimate system process.

### Memory Operations
All VirtualAllocEx, WriteProcessMemory, CreateRemoteThread calls use the existing handle. From the OS perspective, svchost is doing these operations, not some random injector.

## Architecture & Diagrams

### Execution Sequence

```
t=0  Loader starts
     └─ SeDebugPrivilege enabled

t=1  Handle discovery
     └─ Scan svchost/explorer/dwm for existing handles

t=2  Intermediate acquired
     └─ OpenProcess(intermediate_pid)

t=3  Thread found
     └─ Scan for safe sleep stub

t=4  Thread hijacked
     ├─ Suspend
     ├─ Redirect RIP
     └─ Resume

t=5  ProxyWorker executes
     ├─ Map DLL via existing handle
     ├─ Write image
     ├─ Create shellcode
     └─ Hijack Target thread

t=6  Cleanup & done
```

### Key Difference

```
Traditional:
Loader.exe → OpenProcess(Target) ✗ DETECTED
           → VirtualAllocEx ✗ DETECTED
           → CreateRemoteThread ✗ DETECTED

Handle Hijacking:
Loader.exe → OpenProcess(Intermediate) ✓ Normal
           → Hijack thread
           → ProxyWorker uses existing handle
                └─ VirtualAllocEx ✓ Appears from Intermediate
                └─ WriteProcessMemory ✓ Looks legitimate
                └─ CreateRemoteThread ✓ From trusted process
```

## Related Research

I've published other research projects analyzing anti-cheat systems that informed this work:

- **[cs2-vac-internals](https://github.com/Aspasia1337/cs2-vac-internals)** - Analysis of VAC internal mechanisms and detection vectors
- **[VAC-ModuleDumper](https://github.com/Aspasia1337/VAC-ModuleDumper)** - Tools for understanding VAC's module inspection capabilities

These projects revealed that VAC focuses heavily on monitoring newly created handles and process access events, but doesn't actively track reuse of existing handles. That observation is core to understanding why handle hijacking works.

## Other Great Implementations

There are excellent open-source projects implementing similar injection techniques:

- **[GuidedHacking Injector](https://github.com/guidedhacking/GuidedHacking-Injector)** - Well-engineered DLL injection framework
- **[Blackbone](https://github.com/DarthTon/Blackbone)** - Process manipulation library with injection capabilities

If you're learning about injection techniques, these projects are worth studying.

---

If you're interested in Windows internals, reverse engineering, or how anti-cheat systems work, I hope this was interesting.

**Happy researching.**

handle-hijacker

handle-hijacker Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

handle-hijacker

handle-hijacker Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README