Handler class for the NtCreateThreadEx system call. More...

#include <NtCreateThreadEx.hh>

Inheritance diagram for introvirt::windows::nt::NtCreateThreadEx:

[legend]

Collaboration diagram for introvirt::windows::nt::NtCreateThreadEx:

[legend]

Public Member Functions
virtual guest_ptr< void >	StartRoutinePtr () const =0
	Getter for StartRoutinePtr.

virtual guest_ptr< void >	ArgumentPtr () const =0
	Getter for ArgumentPtr.

virtual ThreadCreateFlags	CreateFlags () const =0
	Getter for CreateFlags.

virtual guest_ptr< void >	ZeroBitsPtr () const =0
	Getter for ZeroBitsPtr.

virtual uint64_t	StackSize () const =0
	Getter for StackSize.

virtual uint64_t	MaximumStackSize () const =0
	Getter for MaximumStackSize.

virtual guest_ptr< void >	AttributeListPtr () const =0
	Getter for AttributeListPtr.

virtual void	StartRoutinePtr (const guest_ptr< void > &pStartRoutine)=0
	Setter for StartRoutinePtr.

virtual void	ArgumentPtr (const guest_ptr< void > &pArgument)=0
	Setter for ArgumentPtr.

virtual void	CreateFlags (ThreadCreateFlags CreateFlags)=0
	Setter for CreateFlags.

virtual void	ZeroBitsPtr (const guest_ptr< void > &pZeroBits)=0
	Setter for ZeroBitsPtr.

virtual void	StackSize (uint64_t StackSize)=0
	Setter for StackSize.

virtual void	MaximumStackSize (uint64_t MaximumStackSize)=0
	Setter for MaximumStackSize.

virtual void	AttributeListPtr (const guest_ptr< void > &pAttributeList)=0
	Setter for AttributeListPtr.

virtual uint32_t	ZeroBits () const =0

virtual void	ZeroBits (uint32_t ZeroBits)=0

virtual const PS_ATTRIBUTE_LIST *	AttributeList () const =0

virtual PS_ATTRIBUTE_LIST *	AttributeList ()=0

Public Member Functions inherited from introvirt::windows::nt::NtCreateThreadBase
virtual guest_ptr< void >	ThreadHandlePtr () const =0
	Getter for ThreadHandlePtr.

virtual THREAD_ACCESS_MASK	DesiredAccess () const =0
	Getter for DesiredAccess.

virtual guest_ptr< void >	ObjectAttributesPtr () const =0
	Getter for ObjectAttributesPtr.

virtual uint64_t	ProcessHandle () const =0
	Getter for ProcessHandle.

virtual void	ThreadHandlePtr (const guest_ptr< void > &pThreadHandle)=0
	Setter for ThreadHandlePtr.

virtual void	DesiredAccess (THREAD_ACCESS_MASK DesiredAccess)=0
	Setter for DesiredAccess.

virtual void	ObjectAttributesPtr (const guest_ptr< void > &pObjectAttributes)=0
	Setter for ObjectAttributesPtr.

virtual void	ProcessHandle (uint64_t ProcessHandle)=0
	Setter for ProcessHandle.

virtual uint64_t	ThreadHandle () const =0

virtual void	ThreadHandle (uint64_t ThreadHandle)=0

virtual const OBJECT_ATTRIBUTES *	ObjectAttributes () const =0

virtual OBJECT_ATTRIBUTES *	ObjectAttributes ()=0

virtual std::shared_ptr< THREAD >	get_new_thread ()=0
	Get the newly created THREAD object.

virtual const std::shared_ptr< THREAD >	get_new_thread () const =0
	Get the newly created THREAD object.

Public Member Functions inherited from introvirt::windows::nt::NtSystemCall
virtual NTSTATUS	result () const =0
	Get the result code.

virtual void	result (NTSTATUS_CODE code)=0
	Set the result code.

Public Member Functions inherited from introvirt::windows::WindowsSystemCall
virtual SystemCallIndex	index () const =0
	Get the system call number.

Public Member Functions inherited from introvirt::SystemCall
virtual const std::string &	name () const =0
	Get the name of the system call.

virtual void	write (std::ostream &os=std::cout) const =0
	Write a human-readable description of this system call.

virtual Json::Value	json () const =0

virtual bool	will_return () const =0

virtual void	data (const std::string &key, const std::shared_ptr< void > &value)=0
	Store arbitrary data with the SystemCall.

virtual void	data (const std::string &key, std::shared_ptr< void > &&value)=0
	Store arbitrary data with the SystemCall.

virtual std::shared_ptr< void >	data (const std::string &key)=0
	Retrieve arbitrary data stored with the SystemCall.

virtual std::shared_ptr< const void >	data (const std::string &key) const =0
	Retrieve arbitrary data stored with the SystemCall.

virtual bool	supported () const =0
	Check if this system call is supported by a more specific handler.

virtual void	handle_return_event (Event &event)=0
	Handle a system call return event.

virtual	~SystemCall ()=default
	Destroy the instance.

Static Public Member Functions
static NTSTATUS	inject (uint64_t &ThreadHandle, THREAD_ACCESS_MASK DesiredAccess, const guest_ptr< void > &pObjectAttributes, uint64_t ProcessHandle, const guest_ptr< void > &pStartRoutine, const guest_ptr< void > &pArgument, ThreadCreateFlags CreateFlags, const uint32_t &ZeroBits, uint64_t StackSize, uint64_t MaximumStackSize, const guest_ptr< void > &pAttributeList)

Detailed Description

Handler class for the NtCreateThreadEx system call.

Member Function Documentation

◆ ArgumentPtr() [1/2]

virtual guest_ptr< void > introvirt::windows::nt::NtCreateThreadEx::ArgumentPtr ( ) const

pure virtual

Getter for ArgumentPtr.

Returns: The address pointed to by the the ArgumentPtr parameter

◆ ArgumentPtr() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::ArgumentPtr ( const guest_ptr< void > & pArgument )

pure virtual

Setter for ArgumentPtr.

Parameters

pArgument The address to set for the ArgumentPtr parameter

◆ AttributeList() [1/2]

virtual const PS_ATTRIBUTE_LIST * introvirt::windows::nt::NtCreateThreadEx::AttributeList ( ) const

pure virtual

◆ AttributeList() [2/2]

virtual PS_ATTRIBUTE_LIST * introvirt::windows::nt::NtCreateThreadEx::AttributeList ( )

pure virtual

◆ AttributeListPtr() [1/2]

virtual guest_ptr< void > introvirt::windows::nt::NtCreateThreadEx::AttributeListPtr ( ) const

pure virtual

Getter for AttributeListPtr.

Returns: The address pointed to by the the AttributeListPtr parameter

◆ AttributeListPtr() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::AttributeListPtr ( const guest_ptr< void > & pAttributeList )

pure virtual

Setter for AttributeListPtr.

Parameters

pAttributeList The address to set for the AttributeListPtr parameter

◆ CreateFlags() [1/2]

virtual ThreadCreateFlags introvirt::windows::nt::NtCreateThreadEx::CreateFlags ( ) const

pure virtual

Getter for CreateFlags.

Returns: The value of the CreateFlags parameter

◆ CreateFlags() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::CreateFlags ( ThreadCreateFlags CreateFlags )

pure virtual

Setter for CreateFlags.

Parameters

CreateFlags The value to set for the CreateFlags parameter

◆ inject()

static NTSTATUS introvirt::windows::nt::NtCreateThreadEx::inject	(	uint64_t &	ThreadHandle,
		THREAD_ACCESS_MASK	DesiredAccess,
		const guest_ptr< void > &	pObjectAttributes,
		uint64_t	ProcessHandle,
		const guest_ptr< void > &	pStartRoutine,
		const guest_ptr< void > &	pArgument,
		ThreadCreateFlags	CreateFlags,
		const uint32_t &	ZeroBits,
		uint64_t	StackSize,
		uint64_t	MaximumStackSize,
		const guest_ptr< void > &	pAttributeList
	)

static

◆ MaximumStackSize() [1/2]

virtual uint64_t introvirt::windows::nt::NtCreateThreadEx::MaximumStackSize ( ) const

pure virtual

Getter for MaximumStackSize.

Returns: The value of the MaximumStackSize parameter

◆ MaximumStackSize() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::MaximumStackSize ( uint64_t MaximumStackSize )

pure virtual

Setter for MaximumStackSize.

Parameters

MaximumStackSize The value to set for the MaximumStackSize parameter

◆ StackSize() [1/2]

virtual uint64_t introvirt::windows::nt::NtCreateThreadEx::StackSize ( ) const

pure virtual

Getter for StackSize.

Returns: The value of the StackSize parameter

◆ StackSize() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::StackSize ( uint64_t StackSize )

pure virtual

Setter for StackSize.

Parameters

StackSize The value to set for the StackSize parameter

◆ StartRoutinePtr() [1/2]

virtual guest_ptr< void > introvirt::windows::nt::NtCreateThreadEx::StartRoutinePtr ( ) const

pure virtual

Getter for StartRoutinePtr.

Returns: The address pointed to by the the StartRoutinePtr parameter

◆ StartRoutinePtr() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::StartRoutinePtr ( const guest_ptr< void > & pStartRoutine )

pure virtual

Setter for StartRoutinePtr.

Parameters

pStartRoutine The address to set for the StartRoutinePtr parameter

◆ ZeroBits() [1/2]

virtual uint32_t introvirt::windows::nt::NtCreateThreadEx::ZeroBits ( ) const

pure virtual

◆ ZeroBits() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::ZeroBits ( uint32_t ZeroBits )

pure virtual

◆ ZeroBitsPtr() [1/2]

virtual guest_ptr< void > introvirt::windows::nt::NtCreateThreadEx::ZeroBitsPtr ( ) const

pure virtual

Getter for ZeroBitsPtr.

Returns: The address pointed to by the the ZeroBitsPtr parameter

◆ ZeroBitsPtr() [2/2]

virtual void introvirt::windows::nt::NtCreateThreadEx::ZeroBitsPtr ( const guest_ptr< void > & pZeroBits )

pure virtual

Setter for ZeroBitsPtr.

Parameters

pZeroBits The address to set for the ZeroBitsPtr parameter

The documentation for this class was generated from the following file:

/home/runner/work/IntroVirt/IntroVirt/include/introvirt/windows/kernel/nt/syscall/NtCreateThreadEx.hh

Public Member Functions

Static Public Member Functions

Detailed Description

Member Function Documentation

◆ ArgumentPtr() [1/2]

◆ ArgumentPtr() [2/2]

◆ AttributeList() [1/2]

◆ AttributeList() [2/2]

◆ AttributeListPtr() [1/2]

◆ AttributeListPtr() [2/2]

◆ CreateFlags() [1/2]

◆ CreateFlags() [2/2]

◆ inject()

◆ MaximumStackSize() [1/2]

◆ MaximumStackSize() [2/2]

◆ StackSize() [1/2]

◆ StackSize() [2/2]

◆ StartRoutinePtr() [1/2]

◆ StartRoutinePtr() [2/2]

◆ ZeroBits() [1/2]

◆ ZeroBits() [2/2]

◆ ZeroBitsPtr() [1/2]

◆ ZeroBitsPtr() [2/2]