Manual Map Injector Engineering

Manual-map / stealth injector engineering

Synthesizes patterns from injector trees (Sastasha-class, Xenos/Blackbone-class, Xenox options, kdmapper-style driver delivery).

Technique matrix

Hardening checklist (payload delivery)

• Architecture detect x64/WOW64
• Relocs, imports, delayed imports, TLS, exceptions/unwind
• Section protect final W^X (no long RWX)
• Optional header wipe / name unlink
• Least-privilege handles; transient opens
• File-backed SEC_IMAGE dual views when useful
• Call stack spoof on sensitive APIs (anti-cheat-stack-walk-stealth)

Local corpora

• Desktop/Injectors/Sastasha Injector v1.7*
• Desktop/Injectors/Xenos-master, Xenox v2.3.2
• Desktop/Injectors/kdmapper v3.0.1
• Hypervisor-SVM / VEN / Milkyway trees as available

Full manual-map sequence (correct order, or crashes)

1.  Parse PE (pefile on the tool side; payload-side: minimal parser)
2.  Allocate: SizeOfImage at preferred base (or ASLR-random anywhere)
    - allocation type: MEM_COMMIT|MEM_RESERVE; protect RW first
3.  Copy headers, then each section (SizeOfHeaders, section by section,
    honoring PointerToRawData vs VirtualAddress and VirtualSize > SizeOfRawData tail zeroing)
4.  Base relocations: apply delta to every BASE_RELOCATION block entry
    (type DIR64 for x64; skip ABSOLUTE)
5.  Import resolution: IAT walk — GetProcAddress via parent, or load-free:
    hash-resolve from ntdll/kernel32 export tables directly (API-set resolution:
    apiset host maps via `ApiSetSchema` — easier: link against ntdll only)
6.  Delayed imports (optional): resolve lazily or upfront
7.  TLS: TlsAlloc index, replicate ThreadLocalStoragePointer for calling thread,
    run TLS callbacks (DLL_PROCESS_ATTACH)
8.  Exception support: RtlAddFunctionTable(image, RUNTIME_FUNCTION count, base)
9.  Final protections: per-section R/RX/RW via NtProtectVirtualMemory (W^X)
10. Invoke entry (DllMain ATTACH or explicit init export) from:
    hijacked thread / APC / NtCreateThreadEx (spoofed start address)
11. Post-run hygiene: wipe headers (optional), wipe loader stub, close handles

Import strategies ranked by stealth

Entry-invoke details that bite

• DllMain in loader lock: no LoadLibrary/sync/COM inside; keep init thin, spawn worker from init.
• WOW64: 32-bit target from 64-bit injector — either run a 32-bit helper process (heavily easiest) or use NtQueryInformationProcess ProcessWow64Information to walk 32-bit PEB; heaven's-gate both directions for syscalls (wow64 transitions via 0x33/0x23 code segments).
• CFG: /guard:cf- payload OR SetProcessValidCallTargets on every indirect target range (see stealth-injectors deep section).

kdmapper-class driver delivery

• Vulnerable driver (iqvw64e/RTCore/etc., see byovd) exposes arbitrary physical write primitive → map driver:
  1. ZwCreateSection on driver file → physical addresses of image pages
  2. Allocate kernel pool (driver's own alloc primitive) → copy sections with relocs to kernel VA
  3. Resolve kernel imports via MmGetSystemRoutineAddress-equivalent through primitive
  4. Call DriverEntry via kernel thread spawn primitive or hijack
• Post-map: free/integrity-restore the vulnerable driver; scrub its service/prefetch traces.
• Ban-stack cost: BYOVD detection (Microsoft blocklist, EAC lists) — eac-ban-stack, cheat-longevity-engineering.

SEC_IMAGE dual-mapping trick (file-backed stealth)

• NtCreateSection(SEC_IMAGE) on a payload file, map RX view in target; second RW mapping of same section object (different VAs) lets you mutate bytes without RWX — walk IAT through RW view, execute through RX view. Unlink from module list happens naturally if loaded via NtCreateSection from parent without LdrLoadDll.
• Detection: image-load callbacks only fire on LdrLoadDll path — this path is quiet; ETW-DLL-loads misses it too.

Pair with

stealth-injectors, pe-tools, driver-comm, anti-cheat-stack-walk-stealth.