Skip to content

Commit 5683246

Browse files
authored
Update README.md
1 parent 4860847 commit 5683246

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

README.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,14 @@ Multiple fallback methods are present incase we cannot somehow allocate memory f
1717

1818
Since different Windows builds might have different syscall dispatch numbers, you'll want to make sure that 0x166 and 0x167 are the correct ones for `NtQueueApcThreadEx` and `NtQueueApcThreadEx2` on your machine. These can be found by viewing these routines in a disassembler and seeing what number it is in the second instruction of the routine, which usually looks like `mov rax,00000166`. In the worst case when the `NtQueueApcThreadEx2` cannot be located dynamically, the `QueueUserAPC` is used as a fallback method. Some of my other projects have already explored that this routine can be easily blocked by patching over `ntdll!Ordinal8` (on x64), so it's not ideal. The lower-level `NtQueueApcThreadEx` routines can also be patched over, which is why we want to ideally execute our own syscall stub (which gets allocated into memory each time a queued routine is called).
1919

20+
## Example Output:
21+
```
22+
APC-scheduled routine
23+
Arguments: 26500, 6334, 18467, 41
24+
APC-scheduled routine
25+
Arguments: 29358, 11478, 15724, 19169
26+
APC-scheduled routine
27+
Arguments: 28145, 5705, 24464, 26962
28+
APC-scheduled routine
29+
Arguments: 491, 9961, 16827, 23281
30+
```

0 commit comments

Comments
 (0)