Comment on page
QueueUserAPC() + NtTestAlert()
Use the previously documented QueueUserAPC() function to create an APC in the main thread, but then force the kernel to execute that thread.
You can use
NtTestAlert()to empty APC queue for the current thread. If the queue was empty before the call,
NtTestAlert()has no effect.
- Create a new sacrificial process in a suspended state
- Allocate some memory in the process
- Write shell-code to the remote process, or write a DLL to the process
- Queue a new procedure call in the process thread
- Force the alert to the kernel