A short X post claims a Windows technique that starts with SYSTEM, takes a PPL process PID, and writes caller supplied code into that process memory. The author also says it is unfinished and only works on some PCs, so the value is in the boundary questions more than in any proven bypass.