Function TestProcessSpawnWithSectionMapping

RedTest/redtest.cpp:608–794

// =============================================================================

void TestProcessSpawnWithSectionMapping() {
    printf("\n=== TEST 5: Process Spawn with Section Mapping Injection ===\n\n");

    // Load NT API functions
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        printf("[!] Failed to get ntdll.dll handle\n");
        return;
    }

    pNtCreateSection NtCreateSection = (pNtCreateSection)GetProcAddress(hNtdll, "NtCreateSection");
    pNtMapViewOfSection NtMapViewOfSection = (pNtMapViewOfSection)GetProcAddress(hNtdll, "NtMapViewOfSection");
    pNtUnmapViewOfSection NtUnmapViewOfSection = (pNtUnmapViewOfSection)GetProcAddress(hNtdll, "NtUnmapViewOfSection");

    if (!NtCreateSection || !NtMapViewOfSection || !NtUnmapViewOfSection) {
        printf("[!] Failed to resolve NT API functions\n");
        return;
    }

    printf("[Main] NT API functions resolved successfully\n");

    STARTUPINFOA si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    si.cb = sizeof(si);

    printf("[Main] Spawning child process (notepad.exe) in suspended state...\n");
    if (!CreateProcessA(
        "C:\\Windows\\System32\\notepad.exe",
        NULL,
        NULL,
        NULL,
        FALSE,
        CREATE_SUSPENDED,
        NULL,
        NULL,
        &si,
        &pi)) {
        printf("[!] CreateProcess failed: %lu\n", GetLastError());
        return;
    }

    printf("[Main] Process created - PID: %lu, TID: %lu\n", pi.dwProcessId, pi.dwThreadId);

    // Create a memory section
    HANDLE hSection = NULL;
    SIZE_T shellcodeSize = sizeof(g_dummyShellcode);
    LARGE_INTEGER sectionSize = { 0 };
    sectionSize.QuadPart = shellcodeSize;

    NTSTATUS status = NtCreateSection(
        &hSection,
        SECTION_ALL_ACCESS,
        NULL,
        &sectionSize,
        PAGE_EXECUTE_READWRITE,
        SEC_COMMIT,
        NULL
    );