⚠️ Educational Research Only
This repository contains security research for educational purposes and authorized use only.
Use responsibly and in accordance with all applicable laws and regulations.

📖 Overview

Thread Pool Timer Process Injection is a novel technique that leverages the Windows thread pool infrastructure to execute shellcode. By combining traditional DLL injection with the CreateThreadpoolTimer API, this method enables in-memory code execution through legitimate system-managed threads—potentially bypassing many modern detection mechanisms.

This approach introduces a stealthy execution vector that avoids classic API hooks such as CreateRemoteThread, NtCreateThreadEx, and APCs, making it highly attractive for red team operations and malware research.

🔬 Research Contribution

This project presents the first publicly documented use of CreateThreadpoolTimer for shellcode execution in a process injection scenario. Extensive searches across research portals, GitHub, and offensive security communities confirmed the uniqueness of this implementation for these WIN API for injection.

💡 Key Highlights

Novel Execution Vector: Utilizes Windows thread pool timer callbacks to run shellcode.
Legitimate Infrastructure: Executes code within native Windows-managed worker threads.
Evasion Potential: Generates telemetry that differs from well-known injection behaviors.
API Innovation: Unique pairing of CreateThreadpoolTimer with a custom injection strategy.

🛠️ Technical Implementation

🔄 Execution Flow

Injection Phase:
Traditional DLL injection into the target process using CreateRemoteThread and LoadLibraryW.

Timer Setup:
Thread pool timer is created using CreateThreadpoolTimer() and armed via SetThreadpoolTimer().

Callback Execution:
The configured timer fires inside the target process's context and triggers the callback function.

Code Execution:
Shellcode or malicious logic is executed directly via the timer callback mechanism.

🧩 Core Components

🛠 Main Injector (`Injector.cpp`)

Process enumeration and targeting logic
DLL injection using CreateRemoteThread and LoadLibraryW
Error handling and execution status reporting

⏲ Timer DLL (`TimerDLL.cpp`)

Timer-based shellcode execution implementation
TP_CALLBACK_ENVIRON structure setup for thread pool configuration
Execution of shellcode via the timer callback

📋 API Sequence

🧪 Traditional Injection APIs

OpenProcess()           // Access the target process
VirtualAllocEx()        // Allocate memory in remote process  
WriteProcessMemory()    // Write shellcode or DLL path
CreateRemoteThread()    // Create a remote thread to execute payload
LoadLibraryW()          // Load a DLL via thread execution


⏱️ Thread Pool Timer-Based APIs

InitializeThreadpoolEnvironment()  // Configure threadpool callback environment
CreateThreadpoolTimer()            // Create a timer object
SetThreadpoolTimer()               // Schedule the timer for execution
TimerCallback()                    // Callback function that executes shellcode

README.md

🧬 Thread Pool Timer Process Injection