.
current ETHREAD, but we’re trying to be respectable(?) rootkit authors(??) here, so let’s just avoid the endless blue-screen party which attempting this approach will inevitably become. — My choice for approaching this issue was to use an unmodified user-mode APC to inject, and to simply find a way