feat: add --early-bird APC injection technique - #11
Merged
Conversation
Adds a third injection path alongside the existing QueueUserAPC default and the --nt (NtQueueApcThread) variant. Early Bird APC queues shellcode into a CREATE_SUSPENDED process before its primary thread has executed any user-mode code. A newly created suspended thread begins in an alertable state, so QueueUserAPC fires immediately on ResumeThread -- ahead of the process entry point and therefore ahead of any in-process defensive hooks loaded via the normal DLL initialisation sequence. - Program.cs: ParseUseEarlyBird(), explicit --early-bird branch in Main with technique commentary; usage string updated - ProgramTests.cs: 5 new tests (parse flag, case-insensitive, URL skip, mutual exclusion with --nt) - Total tests: 16 (up from 11) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--early-birdas a third injection path alongside--nt(NtQueueApcThread) and the default (QueueUserAPC)CREATE_SUSPENDEDprocess before its primary thread executes any user-mode code; the APC fires onResumeThread, ahead of the entry point and ahead of in-process hooks loaded during DLL initialisationTechnique summary
QueueUserAPC--ntNtQueueApcThread--early-birdQueueUserAPCResumeThread, before entry pointTest plan
dotnet test— 16/16 pass locally🤖 Generated with Claude Code