Code injection to system process via APC(lsass.exe)

I allocated an RWX (PAGE_EXECUTE_READWRITE) memory region inside LSASS.exe (i tried a RX codecave), then wrote my shellcode there.

After that, I tried to execute my shellcode via NtQueueApcThread → directly pointing to the shellcode. I verified in WinDbg that there are alertable threads inside LSASS.exe.

Initially, I assumed Control Flow Guard (CFG) might be blocking this, so I switched to a different technique: NtQueueApcThread → NtContinue → shellcode, where I set up a CONTEXT structure with Rip pointing to my shellcode and queued a user APC to NtContinue with this context.

However, none of these attempts succeeded — each time, the target thread would immediately crash into an int 29h (STATUS_STACK_BUFFER_OVERRUN) exception even before reaching NtContinue or my shellcode.

Worth mentioning: PPL protection was not present on this LSASS instance.

Possible reasons I suspect:

Control Flow Guard (CFG) still validating APC routine addresses inside system processes like LSASS.exe, even without PPL.

Stack misalignment or corrupt CONTEXT being detected before APC delivery.

APC routine address failing validation against LSASS CFG bitmap.

If anyone has reliable experience with APC injection into LSASS or other protected processes on recent Windows builds (10/11+), would appreciate feedback or working approaches for bypassing these obstacles.

Should i post registers values when thread drops in int 29?Code