RegistryInjector-Reader

Registry Stagger-Reader: Injecting Shellcode from Windows Registry This repository demonstrates a malware model that reads XOR-encrypted shellcode from the Windows Registry, decrypts it, and injects it into a remote process. The project is written in C and showcases basic techniques in shellcode injection and process manipulation. Features Registry Shellcode Storage: Shellcode is stored in a specific registry key and read by the malware during execution. XOR Encryption/Decryption: The shellcode is encrypted with XOR and decrypted dynamically before injection. Process Injection: Injects shellcode into a target process using CreateRemoteThread. Technical Overview XOR Shellcode Encryption Encryption: Shellcode is XOR-encrypted using a single-byte key (0x46). Decryption: The malware reads the encrypted shellcode from the registry and decrypts it before injecting. Process Injection OpenProcess: Opens a handle to the target process for shellcode injection. Memory Allocation: Allocates memory in the target process using VirtualAllocEx. Injection: Writes the shellcode to the allocated memory and executes it using CreateRemoteThread. Usage