The Curious Case of QueueUserAPC

This report analyzes a technique where the .NET CLR causes a process's main thread to enter an alertable state during shutdown, allowing QueueUserAPC callbacks queued to that thread (including those injected from another process) to execute without managed code explicitly calling alertable APIs. Through debugger-assisted dynamic testing (WinDbg/SOS) and reading CoreCLR source, the author traces the behavior to EEShutDown and finalizer/wait logic, demonstrates race conditions for APC-based process injection against freshly spawned .NET processes, and outlines offensive and defensive implications.