[xjk220]

Hi all, i am trying to understand ZwImpersonateThread , i dont find any information online.
Analyzed zeroaccess dll

it calls ZwOpenProcess -> ZwOpenThread -> ZwImpersonateThread , if it the call was success, dll adjusts privileges. i wanted to understand how can be this function useful. thx

[Siro]

Can you be more specific with your question?

What is it that you want to understand? How ZwImpersonateThread works internally? Or how to use it? Or what to use it for?

[xjk220]

Can you be more specific with your question?

What is it that you want to understand? How ZwImpersonateThread works internally? Or how to use it? Or what to use it for?

yes exactly, any possible scenario where ZwImpersonateThread can be useful

[EP_X0FF]

https://googleprojectzero.blogspot.com/ ... andle.html

[xjk220]

https://googleprojectzero.blogspot.com/ ... andle.html

that article was really helpful, thanks EP_X0FF