Process Cloning
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
_xeroxz 15dd8d2e08 changed mem_ctx to ptm_ctx 1 year ago
img init commit 2 years ago
pclone changed mem_ctx to ptm_ctx 1 year ago Update 2 years ago
pclone.sln init commit 2 years ago


pclone is small project designed to clone running processes. The cloning does not clone threads nor handles, it does however clone all virtual memory. It does this by swapping dirbase in the clones EPROCESS structure. It also swaps the PEB in the EPROCESS structure so the clone will list the same loaded modules as the cloned process.


To make a pclone_ctx you must create a vdm_ctx and you must have a process id you want to clone. Once you have both of those you can clone a process.

pclone_ctx clone_ctx(vdm, util::get_pid("notepad.exe"));

// clone_pid is the pid of the new clone process
// clone_handle is a PROCESS_ALL_ACCESS handle which you can
// use to call VirtualAllocEx, ReadProcessMemory, WriteProcessMemory... etc...
const auto [clone_pid, clone_handle] = clone_ctx.clone();


As you can see here I clone notepad using a RuntimeBroker.exe as a dummy process to use as the clone. The loaded modules list the ones in notepad.exe and all the virtual memory is the same as it is in notepad.exe