🔀 LdrShuffle

Code execution/injection technique using _LDR_DATA_TABLE_ENTRY structure manipulation in PEB to redirect EntryPoint of loaded DLLs. Allows code execution without using classic APIs like CreateRemoteThread or QueueUserAPC.

🔗 Source:
https://github.com/RWXstoned/LdrShuffle

#windows #peb #dll #injection #evasion

💉 P³ — Shellcode Loader: Process Parameter Poisoning

This loader implements a code injection technique that leverages the Windows Process Parameters structure (PEB) as a staging and execution location for remote shellcode injection.

By passing payload data implicitly through standard parameters like CommandLine, Environment, or ShellInfo, it bypasses EDR detection because it doesn't touch heavily monitored APIs like VirtualAllocEx, WriteProcessMemory, or CreateRemoteThread. Since it runs without spawning suspended processes or relying on process hollowing, it leaves virtually no obvious footprint in the system.

🔗 Research:
https://sensepost.com/blog/2026/process-parameter-poisoning/

🔗 Source:
https://github.com/Orange-Cyberdefense/p3-loader/

#maldev #injection #edr #bypass #windows #peb