Owoganger

Notice

Working under 64bit with injectable 64bit binary
And there's still no workaround (in my repo) to potential BSOD

Commandline

Here's commandline description
--help to print all the available options (there aren't many)

Required arguments

--source %PATH% replace %PATH% with path to your malicious executable
--dest %PATH replace %PATH% with path to benign executable

Optional arguments

--xor KEY replace KEY with key that you used to xor the binary, it can be one char or multiple chars.

References

https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf