NtCreateThreadEx

Shellcode Loader

Executing shellcode as a thread.

Overview

Eksekusi shellcode dengan NtCreateThreadEx dan tunggu hingga eksekusi tuntas dengan WaitForSingleObject.

NtCreateThreadEx adalah fungsi internal dan bersifat low-level.

NTSTATUS NtCreateThreadEx (PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, PVOID ObjectAttributes, HANDLE ProcessHandle, PVOID lpStartAddress, PVOID lpParameter, ULONG flags, SIZE_T szStackZeroBits, SIZE_T szStackCommitSize, SIZE_T szStackReserveSize, PVOID lpBytesBuffer);

DWORD WaitForSingleObject (HANDLE hHandle, DWORD dwMilliseconds);

Reference

• NTInternals NtCreateThreadEx
• MSDN WaitForSingleObject