NtTerminateThread is returning STATUS_INVALID_HANDLE when terminating self

Question

Hello I am trying to terminate the current thread using NtTerminateThread. I know that the function for the syscall takes 2 arguments which are the thread handle and the exit status but whenever I try to exit the current thread it gives me STATUS_INVALID_HANDLE. Im getting the handle from the function GetCurrentThread which returns 0xfffffffffffffffe.

Im trying to exit with a status of STATUS_SUCCESS which is 0x00000000.

RAX return value showing STATUS_INVALID_HANDLE

ASM:

mov rcx, 0xfffffffffffffffe
mov rdx, 0x0
mov eax, 0x53
syscall

where is r10 init ? 0x53 must not be hardcoded but resolved in run time. and Im trying to exit with a status of STATUS_SUCCESS - you can not do this in any case - impossible — RbMm
– RbMm, Commented Nov 25, 2024 at 0:13
Last time there was a question like this, turned out the NT function swapped the position of the parameters before invoking SYSCALL. I'll note that calling SYSCALL directly is not supported under Windows, and they can (and do) change things around from time to time. — David Wohlferd
– David Wohlferd, Commented Nov 25, 2024 at 0:35

3CEZVQ · Accepted Answer · 2024-11-25 00:38:25Z

2

NtTerminateThread manual: ThreadHandle ... or the NtCurrentThread pseudo-handle If this value is NULL, the calling thread is terminated.

That's all what you need

NtTerminateThread(NULL, STATUS_SUCCESS);

Or

NtTerminateThread(NtCurrentThread(), STATUS_SUCCESS);

GetCurrentThread() is not what the function expected.

answered Nov 25, 2024 at 0:38

3CEZVQ

42.9k11 gold badges92 silver badges100 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

RbMm Over a year ago

Your answer is wrong. GetCurrentThread() simply return NtCurrentThread()

David Wohlferd · Accepted Answer · 2024-12-01 01:03:48Z

0

Your asm code is calling SYSCALL directly. This is unsupported under Windows. Not only can they move things around, but they do move things around. A direct syscall that works today may not tomorrow or may fail on someone else's computer.

That said, looking at the code for NtTerminateThread (on my machine):

00007FFBF5910C20  mov         r10,rcx  
00007FFBF5910C23  mov         eax,53h  
00007FFBF5910C28  test        byte ptr [7FFE0308h],1  
00007FFBF5910C30  jne         00007FFBF5910C35  
00007FFBF5910C32  syscall  
00007FFBF5910C34  ret

So rather than putting the handle in rcx, it goes in r10. And while there is indeed a function named NtCurrentThread, on my machine it's returning the same value as GetCurrentThread (ie 0xfffffffffffffffe).

No, I don't know what's stored at 0x7FFE0308. That's one of the downsides of calling unsupported code. On my machine it was 0. Had the jump been taken, it would have done int 0x2E, which sounds bad.

In conclusion: Call the NtTerminateThread function rather than trying to work around it. It works the way you expect, and is more likely to keep working tomorrow.

edited Dec 1, 2024 at 1:03

answered Nov 25, 2024 at 1:42

David Wohlferd

7,6102 gold badges32 silver badges64 bronze badges

2 Comments

Joshua Over a year ago

int 0x2E -> this context doesn't support the syscall instruction. (That's where the syscall gate lives on old processors.)

David Wohlferd Over a year ago

@Joshua Apparently it's a new thing too: stackoverflow.com/a/70033699/2189500 & amossys.fr/insights/blog-technique/windows10-th2-int2e-mystery

Collectives™ on Stack Overflow

NtTerminateThread is returning STATUS_INVALID_HANDLE when terminating self

2 Answers 2

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related