ntqueueapcthreadex-ntdll-gadget-injection icon indicating copy to clipboard operation
ntqueueapcthreadex-ntdll-gadget-injection copied to clipboard

Published 20 hours ago • verified publisher icon LloydLabs
→

Metadata

This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.

Results 1 ntqueueapcthreadex-ntdll-gadget-injection issues
Sort by recently updated
recently updated
newest added

Adjust for x64 shellcode

3 comment

I'm trying to get this to work for x64 shellcode. The gadget `pop r64; ret` has the same opcodes as `pop r32; ret` (afaik, could be mistaken). However, if I...

vivami avatar vivami

enhancement

← Metadata

223
Stars
33
Forks
Watchers

Owner

verified publisher icon LloydLabs

Metadata

This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.

Back