title: NtCreateThreadEx not working on Windows 10 64bit 1909
body: <p>Recently, I've studied dll injection techniques and I tested them. One of those was dll injection by CreateRemoteThread and NtCreateThreadEx. I investigated CreateRemoteThread and I fount out that it called NtCreateThreadEx internally. The thing is, CreateRemoteThread works fine but NtCreateThreadEx doesn't. The code is as follows.</p>
  <pre><code>struct NtCreateThreadExBuffer {
      ULONG Size;
      ULONG Unknown1;
      ULONG Unknown2;
      PULONG Unknown3;
      ULONG Unknown4;
      ULONG Unknown5;
      ULONG Unknown6;
      PULONG Unknown7;
      ULONG Unknown8;
  };
  
  typedef NTSTATUS(WINAPI *LPFUN_NtCreateThreadEx) (
      OUT PHANDLE hThread,
      IN ACCESS_MASK DesiredAccess,
      IN LPVOID ObjectAttributes,
      IN HANDLE ProcessHandle,
      IN LPTHREAD_START_ROUTINE lpStartAddress,
      IN LPVOID lpParameter,
      IN BOOL CreateSuspended,
      IN ULONG StackZeroBits,
      IN ULONG SizeOfStackCommit,
      IN ULONG SizeOfStackReserve,
      OUT LPVOID lpBytesBuffer
      );
  
  ...
  HMODULE ntdll = GetModuleHandle(L&quot;ntdll.dll&quot;);
  HMODULE kernel32 = GetModuleHandle(L&quot;kernel32.dll&quot;);
  PTHREAD_START_ROUTINE ntCreateThreadExAddr = (PTHREAD_START_ROUTINE)GetProcAddress(ntdll, &quot;NtCreateThreadEx&quot;);
  lpfnLoadLibrary = GetProcAddress(kernel32, &quot;LoadLibraryA&quot;);
  NtCreateThreadExBuffer ntbuffer;
  DWORD dwTmp1 = 0;
  DWORD dwTmp2 = 0;
      
  memset(&amp;ntbuffer, 0, sizeof(NtCreateThreadExBuffer));
  if (ntCreateThreadExAddr)
  {
              ntbuffer.Size = sizeof(struct NtCreateThreadExBuffer);
              ntbuffer.Unknown1 = 0x10003;
              ntbuffer.Unknown2 = 0x8;
              ntbuffer.Unknown3 = &amp;dwTmp2;
              ntbuffer.Unknown4 = 0;
              ntbuffer.Unknown5 = 0x10004;
              ntbuffer.Unknown6 = 4;
              ntbuffer.Unknown7 = &amp;dwTmp1;
              ntbuffer.Unknown8 = 0;
  
          LPFUN_NtCreateThreadEx funNtCreateThreadEx = (LPFUN_NtCreateThreadEx)ntCreateThreadExAddr;
      
          NTSTATUS status = 0;
          status = funNtCreateThreadEx(
                  &amp;hThread,
                  0x1FFFFF,
                  NULL,
                  hCurrp,
                  (LPTHREAD_START_ROUTINE)lpfnLoadLibrary,
                  (LPVOID)param,
                  FALSE,
                  NULL,
                  NULL,
                  NULL,
                  &amp;ntbuffer
              );  
  }
  </code></pre>
  <p>The funny thing about this code is that error code is 31 and status is -1073741819. If anyone knows about this one, please teach me. Thanks in advance.</p>