One Day Sec

What are the limitations and prerequisites for a successful AtomBombing attack?

A successful attack requires at least one thread in the target process to be in an alertable state (e.g., calling `SleepEx`), the ability to call `NtQueueApcThread` with three parameters, and finding suitable RW memory to store the shellcode. Additionally, on Windows 10 and 8.1, Control Flow Guard (CFG) must be bypassed, as discussed in EnSilo's follow-up blog. The technique's complexity means it has a high exploitation threshold, unlike simpler methods like Analysis of .NET Assembly Loading from Memory (execute-assembly) Exploitation.
alertable stateexploitation thresholdCFG bypassNtQueueApcThreadprerequisites

Browse all Q&A →