Thread Pool Timer Process Injection

⚠ Educational Research Only
This repository contains security research for educational purposes and authorized use only.
Use responsibly and in accordance with all applicable laws and regulations.

---

Overview

Thread Pool Timer Process Injection is a technique that leverages the Windows thread pool to execute shellcode. Using the classic DLL injection with CreateThreadpoolTimer to run shellcode in-memory using legit system threads, stealthy, and likely to slip past modern defenses

This approach introduces a stealthy execution vector that avoids classic API hooks such as CreateRemoteThread, NtCreateThreadEx, and APCs, making it highly attractive for red team operations and malware research.

---

---

---

🛠️ Technical Implementation

---

🧩 Core Components

🛠 Main Injector (ConsoleApplication5.cpp)

• Process enumeration and targeting logic
• DLL injection using CreateRemoteThread and LoadLibraryW
• Error handling and execution status reporting

⏲ Timer DLL (Dll1.cpp)

• Timer-based shellcode execution implementation
• TP_CALLBACK_ENVIRON structure setup for thread pool configuration
• Execution of shellcode via the timer callback

⏱️ Thread Pool Timer-Based APIs shellcode execution

🔹 Thread Pool / Timer API InitializeThreadpoolEnvironment Initializes a thread pool callback environment.

CreateThreadpoolTimer Creates a thread pool timer object with callback.

SetThreadpoolTimer Sets the timer to fire after a delay.

CloseThreadpoolTimer Cleans up the timer. // Callback function that executes shellcode