Why did the original APC injection method fail for AtomBombing and how was it overcome?
The standard `QueueUserAPC` function only passes one parameter to the target process, but `GlobalGetAtomName` requires three. The researchers debugged and found that `NtQueueApcThread` (the underlying native API) can pass three parameters, solving the problem. This adaptation is a key innovation in the AtomBombing Exploitation Analysis approach.
APC injectionQueueUserAPCNtQueueApcThreadGlobalGetAtomNameparameter passing