Remote Function Stomping Technique Demonstrated for Windows Process Injection

Security researchers published a proof-of-concept for remote function stomping, a Windows process-injection method that overwrites an existing exported API function inside another process and then runs the injected payload with a remote thread. The demonstration used notepad.exe as the target and selected CallMsgFilterA from user32.dll, resolving the function locally before modifying the remote process with VirtualProtectEx, writing shellcode through WriteProcessMemory, and triggering execution via CreateRemoteThread.

The write-up said the technique depends on the target DLL already being loaded in the remote process and noted that ASLR can affect DLL base addresses across processes. The authors presented the material as educational for malware researchers, red teams, and defenders, but the compiled sample was reportedly flagged as suspicious in an ANY.RUN sandbox, underscoring the detection and abuse potential of the method.