Original Credit goes to @Dark_Puzzle whom disclosed Here the privileged registration. I only expanded upon this to use an additional IOCTL to open a thread (it calls ZwOpenThread())

You can build the shellcode / executable using mingw-w64. To do so, just run from a Unix / MacOS X Installation : x86_64-w64-mingw32-gcc *.c -o ppldump.exe. Currently only supports x64, as I have not been able to obtain a 32 bit version of the zam.sys driver.

Written by Austin Hudson of GuidePoint Security