Get the Whitepaper called Exploit WNF Callback. This is part 3 of a 5 part series of papers.
You can download it from the following link: https://packetstormsecurity.com/files/download/160250/code_injection_series_part3.pdf
Source: https://packetstormsecurity.com/files/160250/Exploit-WNF-Callback-Code-Injection-Series-Part-3.html