I'm reversing a malware which uses a variant of Process Replacement to create a process which I can't dump. I don't know what I'm doing wrong. To be more specific I'll show you the code with images and the routine that this particular malware uses to create a process:

• Call to CreateInternalProcessW which is undocumented. This call contains anothers calls like:
• 

NtCreateUserProcess which creates the process in suspended state but also I can't dump it (access denied is what Process Explorer tells me)

Then it calls to a version of AllocateVirtualMemory

Then 2 calls to ZwWow64WriteVirtualMemory64 and the last one

ZwWriteVirtualMemory

As I tried to do the EB FE trick I looked at the parameters of the 3 processes related to WriteVirtualMemory but I couldn't find what a executable should like to (You know, the MZ beggining and so on).

After the process is created it went trough this

Calling the NtCreateSection() function to create two read/write/execute sections;

Using the NtMapViewOfSection() function to map them into the dropper address space;

Using the NtMapViewOfSection() to map the second section into the new process address space (this section is therefore shared between both processes).

The problem is I can't find the EP to do the EB FE, could be in the parameters of the last 3 calls I put just above ?

If you need more pics or whatever just tell me , and thank you very much

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , but this process hollowing doesn't call to that Api.

This is the exactly what happens:

• CreateProcessA: creates a new process and the process creation flag 0x00000004 is used to create the process in the suspended state

• ReadProcessMemory: reads image base of the suspended process

• NtCreateSection: creates two read/write/execute sections

• ZwMapViewOfSection: maps the read/write/execute sections into the malware’s address space

• ZwMapViewOfSection: maps the second section into the suspended process’s address space (this section is therefore shared between both processes).

• ReadProcessMemory: reads image base of the suspended process’s image into section 1

• ReadProcessMemory: reads image base of the malware’s image into section 2

• NtMapViewOfSection: overwrites the suspended process's entry point code by mapping section 1 to the new process base address

• ResumeThread: resumes the thread of the suspended process executing the injected code

Knowing this, and due english its my not maternal language and there are too much technical words... which call of the apis above should I have a look to find the EP? Probably the last NtMapViewOfSection ?