How create a thread using ZwCreateThreadEx function correctly and wait for your finalization?

0

I mounted this code below where i try create a thread using ZwCreateThreadEx function and want know how make this correctly and wait for your finalization?

===================

#include <ntddk.h>
#include <WinDef.h>

NTSTATUS NTAPI ZwCreateThreadEx(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, IN LPVOID lpStartAddress, IN LPVOID lpParameter, IN BOOL CreateSuspended, IN ULONG StackZeroBits, IN ULONG SizeOfStackCommit, IN ULONG SizeOfStackReserve, OUT LPVOID lpBytesBuffer);

typedef DWORD(__stdcall *LPTHREAD_START_ROUTINE) (
    [in] LPVOID lpThreadParameter
    );

#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004

typedef struct ARGS {
    HANDLE h;
    UNICODE_STRING str;
}ARGS;

void WINAPI ContinueExecution(LPVOID param)
{
    ARGS *pArgs = (ARGS*)param;

    DbgPrint("Thread: %d | %wZ \n", pArgs->h, &pArgs->str);

}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath)
{

HANDLE hThread = 0;

ARGS args;
args.h = 123;
args.str = any UNICODE_STRING value;

NTSTATUS ntStat = ZwCreateThreadEx(&hThread, THREAD_ALL_ACCESS, 0, ZwCurrentProcess(), (LPTHREAD_START_ROUTINE)ContinueExecution, &args, THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER, 0, 0, 0, 0);

if (ntStat >= 0)
{
    KeWaitForSingleObject(hThread, INFINITE);
    ZwClose(hThread);
}
else
{
    DbgPrint("ZwCreateThreadEx failed!");
}

  return STATUS_SUCCESS;
}

EDITION:

I have 2 troubles in this code, the first is relative to definition of ZwCreateThreadEx function that is unresolved external and the second (KeWaitForSingleObject) seems that was solved, see below:

status = KeWaitForSingleObject(&hThread, Executive, KernelMode, FALSE, NULL);
         DbgPrint("KeWaitForSingleObject() status: %#X", status);
c
windows
driver
asked on Stack Overflow Apr 22, 2018 by user9672569 • edited Apr 22, 2018 by user9672569

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0