Rendering on external windows via hijacking thread contexts. You can read a full write-up at: https://secret.club/2020/05/12/abusing-compositions.html
Added notes to what is necessary for this to work inside of a manually mapped driver, and describes why it only works in the IOCTL handler.
The notes can be located in window_hijack\includes\dispatch\control.cpp.
To use the project as-is:
- Enable test-signing mode
- Compile in Release x64
- Load the driver using any traditional driver loader
- Start window_hijack_cli using the following pattern:
window_hijack_cli.exe [window_class_name]
paracord (yousif), IChooseYou