Rogue Messages (Win32)

• Interactive services – receive messages from unprivileged processes.

• All of those messages affect the execution flow.

• Some of those messages copy buffers from unprivileged to privileged space.

• Some of those messages (WM_TIMER) contain pointers that are immediately executed.