Get the Whitepaper called Native Thread Injection – Into The Session Manager Subsystem. Source code included.
You can download it from the following link: https://packetstormsecurity.com/files/download/77371/native_thread_injection.pdf
Source: https://packetstormsecurity.com/files/77371/Whitepaper-Native-Thread-Injection.html