Handler class for the NtCreateThread system call. More...

#include <NtCreateThread.hh>

Inheritance diagram for introvirt::windows::nt::NtCreateThread:

[legend]

Collaboration diagram for introvirt::windows::nt::NtCreateThread:

[legend]

Public Member Functions
virtual guest_ptr< void >	ClientIdPtr () const =0
	Getter for ClientIdPtr.

virtual guest_ptr< void >	ThreadContextPtr () const =0
	Getter for ThreadContextPtr.

virtual guest_ptr< void >	UserStackPtr () const =0
	Getter for UserStackPtr.

virtual bool	CreateSuspended () const =0
	Getter for CreateSuspended.

virtual void	ClientIdPtr (const guest_ptr< void > &pClientId)=0
	Setter for ClientIdPtr.

virtual void	ThreadContextPtr (const guest_ptr< void > &pThreadContext)=0
	Setter for ThreadContextPtr.

virtual void	UserStackPtr (const guest_ptr< void > &pUserStack)=0
	Setter for UserStackPtr.

virtual void	CreateSuspended (bool CreateSuspended)=0
	Setter for CreateSuspended.

virtual const CLIENT_ID *	ClientId () const =0

virtual CLIENT_ID *	ClientId ()=0

virtual const INITIAL_TEB *	UserStack () const =0

virtual INITIAL_TEB *	UserStack ()=0

Public Member Functions inherited from introvirt::windows::nt::NtCreateThreadBase
virtual guest_ptr< void >	ThreadHandlePtr () const =0
	Getter for ThreadHandlePtr.

virtual THREAD_ACCESS_MASK	DesiredAccess () const =0
	Getter for DesiredAccess.

virtual guest_ptr< void >	ObjectAttributesPtr () const =0
	Getter for ObjectAttributesPtr.

virtual uint64_t	ProcessHandle () const =0
	Getter for ProcessHandle.

virtual void	ThreadHandlePtr (const guest_ptr< void > &pThreadHandle)=0
	Setter for ThreadHandlePtr.

virtual void	DesiredAccess (THREAD_ACCESS_MASK DesiredAccess)=0
	Setter for DesiredAccess.

virtual void	ObjectAttributesPtr (const guest_ptr< void > &pObjectAttributes)=0
	Setter for ObjectAttributesPtr.

virtual void	ProcessHandle (uint64_t ProcessHandle)=0
	Setter for ProcessHandle.

virtual uint64_t	ThreadHandle () const =0

virtual void	ThreadHandle (uint64_t ThreadHandle)=0

virtual const OBJECT_ATTRIBUTES *	ObjectAttributes () const =0

virtual OBJECT_ATTRIBUTES *	ObjectAttributes ()=0

virtual std::shared_ptr< THREAD >	get_new_thread ()=0
	Get the newly created THREAD object.

virtual const std::shared_ptr< THREAD >	get_new_thread () const =0
	Get the newly created THREAD object.

Public Member Functions inherited from introvirt::windows::nt::NtSystemCall
virtual NTSTATUS	result () const =0
	Get the result code.

virtual void	result (NTSTATUS_CODE code)=0
	Set the result code.

Public Member Functions inherited from introvirt::windows::WindowsSystemCall
virtual SystemCallIndex	index () const =0
	Get the system call number.

Public Member Functions inherited from introvirt::SystemCall
virtual const std::string &	name () const =0
	Get the name of the system call.

virtual void	write (std::ostream &os=std::cout) const =0
	Write a human-readable description of this system call.

virtual Json::Value	json () const =0

virtual bool	will_return () const =0

virtual void	data (const std::string &key, const std::shared_ptr< void > &value)=0
	Store arbitrary data with the SystemCall.

virtual void	data (const std::string &key, std::shared_ptr< void > &&value)=0
	Store arbitrary data with the SystemCall.

virtual std::shared_ptr< void >	data (const std::string &key)=0
	Retrieve arbitrary data stored with the SystemCall.

virtual std::shared_ptr< const void >	data (const std::string &key) const =0
	Retrieve arbitrary data stored with the SystemCall.

virtual bool	supported () const =0
	Check if this system call is supported by a more specific handler.

virtual void	handle_return_event (Event &event)=0
	Handle a system call return event.

virtual	~SystemCall ()=default
	Destroy the instance.

Static Public Member Functions
static NTSTATUS	inject (uint64_t &ThreadHandle, THREAD_ACCESS_MASK DesiredAccess, const guest_ptr< void > &pObjectAttributes, uint64_t ProcessHandle, const guest_ptr< void > &pClientId, const guest_ptr< void > &pThreadContext, const guest_ptr< void > &pUserStack, bool CreateSuspended)

Detailed Description

Handler class for the NtCreateThread system call.

Member Function Documentation

◆ ClientId() [1/2]

virtual const CLIENT_ID * introvirt::windows::nt::NtCreateThread::ClientId ( ) const

pure virtual

◆ ClientId() [2/2]

virtual CLIENT_ID * introvirt::windows::nt::NtCreateThread::ClientId ( )

pure virtual

◆ ClientIdPtr() [1/2]

virtual guest_ptr< void > introvirt::windows::nt::NtCreateThread::ClientIdPtr ( ) const

pure virtual

Getter for ClientIdPtr.

Returns: The address pointed to by the the ClientIdPtr parameter

◆ ClientIdPtr() [2/2]

virtual void introvirt::windows::nt::NtCreateThread::ClientIdPtr ( const guest_ptr< void > & pClientId )

pure virtual

Setter for ClientIdPtr.

Parameters

pClientId The address to set for the ClientIdPtr parameter

◆ CreateSuspended() [1/2]

virtual bool introvirt::windows::nt::NtCreateThread::CreateSuspended ( ) const

pure virtual

Getter for CreateSuspended.

Returns: The value of the CreateSuspended parameter

◆ CreateSuspended() [2/2]

virtual void introvirt::windows::nt::NtCreateThread::CreateSuspended ( bool CreateSuspended )

pure virtual

Setter for CreateSuspended.

Parameters

CreateSuspended The value to set for the CreateSuspended parameter

◆ inject()

static NTSTATUS introvirt::windows::nt::NtCreateThread::inject	(	uint64_t &	ThreadHandle,
		THREAD_ACCESS_MASK	DesiredAccess,
		const guest_ptr< void > &	pObjectAttributes,
		uint64_t	ProcessHandle,
		const guest_ptr< void > &	pClientId,
		const guest_ptr< void > &	pThreadContext,
		const guest_ptr< void > &	pUserStack,
		bool	CreateSuspended
	)

static

◆ ThreadContextPtr() [1/2]

virtual guest_ptr< void > introvirt::windows::nt::NtCreateThread::ThreadContextPtr ( ) const

pure virtual

Getter for ThreadContextPtr.

Returns: The address pointed to by the the ThreadContextPtr parameter

◆ ThreadContextPtr() [2/2]

virtual void introvirt::windows::nt::NtCreateThread::ThreadContextPtr ( const guest_ptr< void > & pThreadContext )

pure virtual

Setter for ThreadContextPtr.

Parameters

pThreadContext The address to set for the ThreadContextPtr parameter

◆ UserStack() [1/2]

virtual const INITIAL_TEB * introvirt::windows::nt::NtCreateThread::UserStack ( ) const

pure virtual

◆ UserStack() [2/2]

virtual INITIAL_TEB * introvirt::windows::nt::NtCreateThread::UserStack ( )

pure virtual

◆ UserStackPtr() [1/2]

virtual guest_ptr< void > introvirt::windows::nt::NtCreateThread::UserStackPtr ( ) const

pure virtual

Getter for UserStackPtr.

Returns: The address pointed to by the the UserStackPtr parameter

◆ UserStackPtr() [2/2]

virtual void introvirt::windows::nt::NtCreateThread::UserStackPtr ( const guest_ptr< void > & pUserStack )

pure virtual

Setter for UserStackPtr.

Parameters

pUserStack The address to set for the UserStackPtr parameter

The documentation for this class was generated from the following file:

/home/runner/work/IntroVirt/IntroVirt/include/introvirt/windows/kernel/nt/syscall/NtCreateThread.hh

Public Member Functions

Static Public Member Functions

Detailed Description

Member Function Documentation

◆ ClientId() [1/2]

◆ ClientId() [2/2]

◆ ClientIdPtr() [1/2]

◆ ClientIdPtr() [2/2]

◆ CreateSuspended() [1/2]

◆ CreateSuspended() [2/2]

◆ inject()

◆ ThreadContextPtr() [1/2]

◆ ThreadContextPtr() [2/2]

◆ UserStack() [1/2]

◆ UserStack() [2/2]

◆ UserStackPtr() [1/2]

◆ UserStackPtr() [2/2]