Process Hollowing

Writes a buffer from the caller into the virtual address space of a target process.

Creates a section object backed by a file or the system pagefile for shared memory mapping.

Maps a view of a section object into the virtual address space of a target process.

Windows 10 1809+ extended section-mapping syscall that accepts MEM_EXTENDED_PARAMETER constraints.

Unmaps a previously mapped section view from a process's virtual address space.

Creates a new thread in a target process, optionally suspended, with rich attribute list support.

Legacy NT-style process creation from a pre-built section object — predecessor of NtCreateProcessEx and NtCreateUserProcess.

Creates a new process from a section handle without running ntdll process initialization — building block of process hollowing.

Decrements every thread's suspend count in a target process, resuming threads that reach zero.

Decrements the suspend count of a thread, resuming execution when the count reaches zero.

Commits a KTM transaction, atomically persisting every change made under it to disk.