mirror of
https://github.com/winterknife/EVENSTAR
synced 2026-06-21 14:13:51 +00:00
winterknife
44 lines
1.8 KiB
Markdown
44 lines
1.8 KiB
Markdown
# EVENSTAR - KernelToUserInjector
|
|
|
|
## Version
|
|
|
|
- `v3.0.0`
|
|
|
|
## Brief
|
|
|
|
- `ISA: x86`
|
|
- `Mode: Long`
|
|
- `Bitness: 64-bit`
|
|
- `CPL: 0`
|
|
- `OS: Windows`
|
|
- `Language: C`
|
|
- Sample code that demonstrates code injection from kernel-mode into a user-land process using APCs
|
|
|
|
## Usage
|
|
|
|
```
|
|
[DBG]: +++ KernelToUserInjector.sys Loaded +++
|
|
[DBG]: KernelToUserInjector.sys Built May 6 2026 11:07:01
|
|
[DBG]: KernelToUserInjector: DriverObject = FFFFE508AFD7E2F0
|
|
[DBG]: KernelToUserInjector: RegistryPath = \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KernelToUserInjector
|
|
[DBG]: [+] PID of target process: 712
|
|
[DBG]: [+] TID of thread in alertable wait state: 1032
|
|
[DBG]: [+] Payload buffer UVA: 0x0000020B242E0000
|
|
[DBG]: [+] Queued a special kernel APC to the target thread!
|
|
[DBG]: [+] Queued a regular user-mode APC to the target thread!
|
|
[DBG]: --- KernelToUserInjector.sys Unloaded ---
|
|
```
|
|
|
|
## Tested OS Versions
|
|
|
|
- `Windows 11 25H2 Build 26200 Revision 8246 64-bit`
|
|
|
|
## References
|
|
|
|
1. [APC Series: User APC Internals](https://repnz.github.io/posts/apc/kernel-user-apc-api/)
|
|
2. [Aspects of internals of the Asynchronous Procedure Calls from the kernel mode.](https://dennisbabkin.com/blog/?t=depths-of-windows-apc-aspects-of-asynchronous-procedure-call-internals-from-kernel-mode)
|
|
3. [Thread APC](http://uninformed.org/index.cgi?v=3&a=4&p=20)
|
|
4. [Bypassing the Microsoft-Windows-Threat-Intelligence Kernel APC Injection Sensor](https://medium.com/@philiptsukerman/bypassing-the-microsoft-windows-threat-intelligence-kernel-apc-injection-sensor-92266433e0b0)
|
|
5. [Blackbone](https://github.com/DarthTon/Blackbone)
|
|
6. [Circumventing Windows Defender ATP's user-mode APC Injection sensor from Kernel-mode](https://rce4fun.blogspot.com/2019/04/circumventing-windows-defender-atps.html)
|
|
7. [KernelInjector](https://github.com/0mWindyBug/KernelInjector) |