Click here to Skip to main content
15,889,281 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
CSS
I am used to NtCreateThreadEx in window 7 x32 and it work done.
But in in window 7 x64 i couldn't. It failed with error: 0xC0000005 Access Violation.

It may be fail at struct NtCreateTheadExBuffer, but i can't got it.

Please, help me.

My source bellow:

C++
typedef struct
{
ULONG Size;
ULONG Unknown1;
ULONG Unknown2;
PULONG Unknown3;
ULONG Unknown4;
ULONG Unknown5;
ULONG Unknown6;
PULONG Unknown7;
ULONG Unknown8;
} NtCreateTheadExBuffer;

typedef DWORD WINAPI NtCreateThreadExProc(PHANDLE, ACCESS_MASK, LPVOID, HANDLE, LPTHREAD_START_ROUTINE, LPVOID, BOOL, DWORD, DWORD, DWORD, LPVOID);

HANDLE NtCreateThreadEx(HANDLE hProcess, LPVOID lpRemoteThreadStart, LPVOID lpRemoteCallback)
{
HANDLE hRemoteThread = NULL;

ULONG dw0 = 0, dw1 = 0;
NtCreateTheadExBuffer Buffer;
memset(&Buffer, 0, sizeof(NtCreateTheadExBuffer));

Buffer.Size = sizeof(NtCreateTheadExBuffer);
Buffer.Unknown1 = 0x10006;
Buffer.Unknown2 = 0x16;
Buffer.Unknown3 = &dw1;
Buffer.Unknown4 = 0;
Buffer.Unknown5 = 0x10008;
Buffer.Unknown6 = 8;
Buffer.Unknown7 = &dw0;
Buffer.Unknown8 = 0;

NtCreateThreadExProc *NtCreateThreadX =
(NtCreateThreadExProc*)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCreateThreadEx");

if(NtCreateThreadX == NULL)
return NULL;

DWORD dw = 0;
if(!SUCCEEDED(dw = NtCreateThreadX(
&hRemoteThread, //THREAD_ALL_ACCESS, // STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
0x1FFFFF, // All access
NULL,
hProcess,
(LPTHREAD_START_ROUTINE)lpRemoteThreadStart,
lpRemoteCallback,
FALSE,
NULL,
NULL,
NULL, //NULL
&Buffer
)))
{
return NULL;
}

return hRemoteThread;
}
Posted
Updated 14-Feb-17 23:33pm
Comments
[no name] 19-Apr-12 23:06pm    
Are you getting the correct version of ntdll.dll? You should be able to use debugger to find out exactly where this is happening.
[no name] 19-Apr-12 23:30pm    
That could mean anything - you need to use debugger to find out where it is occurring. Also use Google to find out how to ensure you are getting correct ntdll.dll. Do all that first and then ask your question.
Philippe Mori 27-Apr-13 9:27am    
This is an undocumented function so you should not use it. If it works in 32 bits, then it might be either a problem with 32/64 bit borders as explained in one of the solution, or it might be that the definition above is not exactly correct (as it does not come from official documentation but reverse engineering). If the information is not available on the web, then debugging assebly code might be the only way to understand what is happening. There might be also some restriction on who is allowed to call that function and 64 bit environnement might be strictier than 32 bit also. Finally since it is not documented, maybe the function is not even working properly.

1 solution

Sound's silly, but are you trying to cross the 32-bit/64-bit boundary? If you are trying to inject a thread from a 32-bit process into a 64-bit process this will fail. You'll need to compile as 64-bit if that is the case and all will work.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900