Dominik Phillips

Windows kernel data structure - "_HANDLE_TABLE". Every process has one. Whenever you open a file, process, thread, token, event, or mutex, Windows creates a handle entry that maps your user-mode handle to the actual kernel object along with its access rights. This is one of the reasons security researchers spend time understanding it. Handle leaks or overly permissive handles can become powerful primitives for privilege escalation, sandbox escapes, EDR bypasses, and forensic analysis. Sometimes, you don't need to exploit memory corruption, you just need access to the right handle.

In windows, APCs(Asynchronous procedure calls) is a mechanism in which a function executes in the context of the specific thread. It's not an independent execution entity like a thread. void CALLBACK MyCompletionRoutine(...) { printf("Read completed!\n"); } ReadFileEx(..., MyCompletionRoutine); //Async I/O // Later SleepEx(INFINITE, TRUE); // Alertable wait Here, the completion routine runs even before SleepEx returns. Thread | |-- ReadFileEx() | |-- SleepEx(INFINITE, TRUE) | (alertable wait) | |<-- I/O completes |<-- Windows queues User APC | |-- MyCompletionRoutine() <-- APC executes | |-- SleepEx returns WAIT_IO_COMPLETION | |-- Continue execution That's how the below sequence is possible if you have proper rights to open the process handle to suspend. Btw security software can easily catch this because you're suspending a process and allocating memory etc.

This is best channel for windows Internals by @zodiacon He's one of the authors of the iconic windows Internals books. youtube.com/playlist?list=PL…