Skip to content

Instantly share code, notes, and snippets.

@hugsy
Created March 17, 2019 18:10
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hugsy/8df0843e8556f557308cd014fec0fda3 to your computer and use it in GitHub Desktop.
Save hugsy/8df0843e8556f557308cd014fec0fda3 to your computer and use it in GitHub Desktop.
#include <windows.h>
#include <wchar.h>
#pragma comment(lib, "ntdll.lib")
#define ThreadNameInformation 0x26
// mimic nt!UNICODE_STRING
// sizeof(UNICODE_STRING) must be 0x10 for the syscall to succeed.
typedef struct
{
WORD Length;
WORD MaximumLength;
DWORD Padding;
DWORD64 Buffer;
}
UNICODE_STRING, *PUNICODE_STRING;
int wmain(int argc, wchar_t** argv)
{
DWORD dwTid = _wtoi(argv[1]);
PWSTR lpMessageToStore = argv[2];
HANDLE hThread = OpenThread(THREAD_SET_LIMITED_INFORMATION, FALSE, dwTid);
if(!hThread) return -1;
// will result in AllocatePoolWithTag(0x110, "ThNm")
UNICODE_STRING target = {
.Length = 0x100,
.MaximumLength = 0x102,
.Buffer = lpMessageToStore,
};
NtSetInformationThread(hThread, ThreadNameInformation, &target, 0x10);
CloseHandle(hThread);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment