Sliver

Reserves, commits or both a region of virtual memory in a target process.

Changes the protection on a region of committed virtual memory in a target process.

Writes a buffer from the caller into the virtual address space of a target process.

Decommits or releases a region of virtual memory in a target process.

Retrieves information about pages in a target process's virtual address space.

Opens a handle to an existing process with a requested access mask.

Creates a section object backed by a file or the system pagefile for shared memory mapping.

Maps a view of a section object into the virtual address space of a target process.

Creates a new thread in a target process, optionally suspended, with rich attribute list support.

Queues a user APC to a thread with optional reserve object or special-user-APC flag for forced delivery.

Creates a new user-mode process and its initial thread from an executable image.

Decrements every thread's suspend count in a target process, resuming threads that reach zero.

Opens a handle to an existing thread identified by CLIENT_ID with requested access rights.

Increments the suspend count of a target thread, halting its execution.

Terminates the specified thread with the supplied exit status. NULL handle terminates the current thread.

Retrieves the CPU register context (CONTEXT structure) of a suspended thread.

Sets the CPU register context of a thread — the kernel primitive behind thread hijacking and shellcode redirection.

Opens the access token of a process and lets the caller specify handle attributes such as OBJ_INHERIT.

Enables or disables privileges in a specified access token.

Retrieves a specified class of information about an access token.

Creates a new access token that duplicates an existing token, optionally changing its type and impersonation level.

Causes the server thread to impersonate the security context of the client thread.

Retrieves a class of system-wide information — process list, kernel handle table, loaded driver list, code-integrity status, and more.

Creates a named or unnamed event synchronization object and returns a handle to it.

Opens a handle to an existing named event object.

Sets an event object to the signaled state, releasing waiting threads.

Resets an event object to non-signaled and returns its previous signaled state.

Drives an event object to the non-signaled state without returning the previous state.

Waits on up to MAXIMUM_WAIT_OBJECTS dispatcher objects with either WaitAny or WaitAll semantics.

Arms a timer object with a due time, optional period and an optional APC routine fired on expiry.

Cancels a pending NtSetTimer arm and reports whether the timer was still active at cancel time.