I mounted this code below where i try create a thread using ZwCreateThreadEx
function and want know how make this correctly and wait for your finalization?
#include <ntddk.h>
#include <WinDef.h>
NTSTATUS NTAPI ZwCreateThreadEx(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, IN LPVOID lpStartAddress, IN LPVOID lpParameter, IN BOOL CreateSuspended, IN ULONG StackZeroBits, IN ULONG SizeOfStackCommit, IN ULONG SizeOfStackReserve, OUT LPVOID lpBytesBuffer);
typedef DWORD(__stdcall *LPTHREAD_START_ROUTINE) (
[in] LPVOID lpThreadParameter
);
#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004
typedef struct ARGS {
HANDLE h;
UNICODE_STRING str;
}ARGS;
void WINAPI ContinueExecution(LPVOID param)
{
ARGS *pArgs = (ARGS*)param;
DbgPrint("Thread: %d | %wZ \n", pArgs->h, &pArgs->str);
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
HANDLE hThread = 0;
ARGS args;
args.h = 123;
args.str = any UNICODE_STRING value;
NTSTATUS ntStat = ZwCreateThreadEx(&hThread, THREAD_ALL_ACCESS, 0, ZwCurrentProcess(), (LPTHREAD_START_ROUTINE)ContinueExecution, &args, THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER, 0, 0, 0, 0);
if (ntStat >= 0)
{
KeWaitForSingleObject(hThread, INFINITE);
ZwClose(hThread);
}
else
{
DbgPrint("ZwCreateThreadEx failed!");
}
return STATUS_SUCCESS;
}
EDITION:
I have 2 troubles in this code, the first is relative to definition of ZwCreateThreadEx
function that is unresolved external and the second (KeWaitForSingleObject
) seems that was solved, see below:
status = KeWaitForSingleObject(&hThread, Executive, KernelMode, FALSE, NULL);
DbgPrint("KeWaitForSingleObject() status: %#X", status);
User contributions licensed under CC BY-SA 3.0