Skip to content

NtCreateThread call error or bug. #1

Description

@hvprvtr

Hello! Thanks for this instrument!

I try to replace direct syscall of NtCreateThread to indirect. I got next direct call:

ntdll := windows.NewLazySystemDLL("ntdll.dll")
RtlCopyMemory := ntdll.NewProc("RtlCopyMemory")
_, _, errRtlCopyMemory := RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
var oldProtect uint32
errVirtualProtect := windows.VirtualProtect(addr, uintptr(len(shellcode)), windows.PAGE_EXECUTE_READ, &oldProtect)
kernel32 := windows.NewLazySystemDLL("kernel32.dll")
CreateThread := kernel32.NewProc("CreateThread")
_, _, errCreateThread := CreateThread.Call(0, 0, addr, uintptr(0), 0, 0)

Its run my shellcode, all good.

Try to replace by this, but something go wrong.

NTSTATUS, err := superdeye.SuperdSyscall("NtCreateThread", 0, 0, addr, uintptr(0), 0, 0)
if err != nil {
	fmt.Println("Syscall was not executed... Likely the Syscall was not found or a bug...")
	fmt.Println(err.Error())
}
fmt.Println("Syscall NtCreateThreadEx Made with NTSTATUS ", NTSTATUS)

No error, i got log

Syscall NtCreateThreadEx Made with NTSTATUS 3221225485

But shellcode does not start. What i miss?

Activity

  1. almounah commented on May 5, 2025

    @almounah
    Owner

    Hey,

    Check out the documentation of NtCreateThread.

    You can not use the same argument for CreateThread and NtCreateThread as they have different function signature.

    I advise you to check the example provided where I use NtCreateThreadEx.

    Cheers

  2. hvprvtr commented on May 6, 2025

    @hvprvtr
    Author

    Sorry for this, i was inattentive. Fixed function name to CreateThread. Got next error
    Did not find SSN. Double Check Syscall Name then report as a Github issue as this is very interesting.
    CreateThread call is impossible now?

    I cant use NtCreateThreadEx because i need to execute shellcode into current process, not by injection in external process. Can you recommend function i may use, which implemented into your package?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions