so.cl

Rascals are always sociable, and the chief sign that a man has any nobility in his character is the little pleasure he takes in others company. Arthur Schopenhauer

Adventures with KernelCallbackTable Injection

Lately, I came across with KernelCallbackTable which could be abused to inject shellcode in a remote process. This method of process injection was used by FinFisher/FinSpy and Lazarus.
This post walks through the journey I took and the hurdles I encountered to make process injection via KernelCallbackTable work according to what I wanted. Adventures with KernelCallbackTable Injection

Nickname: sizeof(cat)
Job: Consultant, Hacker
PGP key: F273 5495

For a bird born in captivity, flight is a mental illness.