TerminateThread,...but what happens to thread stack?

Process Hacker development discussion
First unread post8 postsPage 1 of 1

TerminateThread,...but what happens to thread stack?

Unread postby keremg » Mon Nov 28, 2011 10:49 am

Reading the documentation for the TerminateThread says, that it will not cleanup the target thread's initial stack,....and afaik this is a leak. I found a function in ntdll.dll that has a interesting name: RtlFreeUserThreadStack(W2K) and RtlFreeUserStack(VISTA+),...is this the possible solution for this? It uses NtFreeVirtualMemory to free something pushing MEM_RELEASE (0x8000) on the stack before calling NtFreeVirtualMemory,...but what is freed and what are the two DWORD sized parameters it expects? Can someone tell me more about this please,... :thinking:


best

K.
User avatar
keremg offline
Posts: 136
Location: Germany

Re: TerminateThread,...but what happens to thread stack?

Unread postby wj32 » Mon Nov 28, 2011 10:56 am

Since Vista the kernel frees the stack.
User avatar
wj32 offline
Posts: 721
Location: Australia
OS: Windows

Re: TerminateThread,...but what happens to thread stack?

Unread postby keremg » Mon Nov 28, 2011 11:06 am

wj32 wrote:Since Vista the kernel frees the stack.

Ok, thats good to know. But what about windows 2000 and XP? There is a member on TEB named DeallocationStack of type PVOID referring to http://en.wikipedia.org/wiki/Thread_Environment_Block. Can this be used in some way?
User avatar
keremg offline
Posts: 136
Location: Germany

Re: TerminateThread,...but what happens to thread stack?

Unread postby wj32 » Mon Nov 28, 2011 11:09 am

keremg wrote:
wj32 wrote:Since Vista the kernel frees the stack.

Ok, thats good to know. But what about windows 2000 and XP? There is a member on TEB named DeallocationStack of type PVOID referring to http://en.wikipedia.org/wiki/Thread_Environment_Block. Can this be used in some way?


I'm not sure...
User avatar
wj32 offline
Posts: 721
Location: Australia
OS: Windows

Re: TerminateThread,...but what happens to thread stack?

Unread postby keremg » Mon Nov 28, 2011 2:57 pm

wj32 wrote:
keremg wrote:
wj32 wrote:Since Vista the kernel frees the stack.

Ok, thats good to know. But what about windows 2000 and XP? There is a member on TEB named DeallocationStack of type PVOID referring to http://en.wikipedia.org/wiki/Thread_Environment_Block. Can this be used in some way?


I'm not sure...


Looks like simply terminating a thread seems not to be a good idea, there seem to be many more resources "orphaned" not just only stack memory,... :(
User avatar
keremg offline
Posts: 136
Location: Germany

Re: TerminateThread,...but what happens to thread stack?

Unread postby nicklowe » Thu Jan 05, 2012 6:28 pm

It is very possible to easily free user mode thread stacks under versions of Windows that otherwise leak them when they're forcefully terminated with a call to NTDLL's RtlFreeUserThreadStack().

I have just started a blog and made a post on this very issue explaining how to use it.

http://www.nicklowe.org/2012/01/thread-termination-dont-leak-the-stack/

Regards,

Nick
nicklowe offline
Posts: 5

Re: TerminateThread,...but what happens to thread stack?

Unread postby keremg » Sat Jan 07, 2012 5:30 am

nicklowe wrote:It is very possible to easily free user mode thread stacks under versions of Windows that otherwise leak them when they're forcefully terminated with a call to NTDLL's RtlFreeUserThreadStack().

I have just started a blog and made a post on this very issue explaining how to use it.

http://www.nicklowe.org/2012/01/thread-termination-dont-leak-the-stack/

Regards,

Nick


Ok, thanks,...
User avatar
keremg offline
Posts: 136
Location: Germany

Re: TerminateThread,...but what happens to thread stack?

Unread postby nicklowe » Tue Jan 15, 2013 3:17 pm

Coming back to this thread a year later... The internals of RtlFreeUserThreadStack are:

Code: Select all
NTSTATUS RtlFreeUserThreadStack(
    HANDLE hProcess,
    HANDLE hThread)
{
    NTSTATUS Status;
    PTEB Teb;
    THREAD_BASIC_INFORMATION ThreadInfo;
    PVOID StackDeallocationBase;
    ULONG Length;
    SIZE_T Size;
    Status = NtQueryInformationThread(hThread,
        ThreadBasicInformation,
        &ThreadInfo,
        sizeof(ThreadInfo),
        NULL);
    Teb = ThreadInfo.TebBaseAddress;
    if (NT_SUCCESS(Status) && Teb)
    {
        Status = NtReadVirtualMemory(hProcess,
            &Teb->DeallocationStack,
            &StackDeallocationBase,
            sizeof(StackDeallocationBase),
            &Length);
        if (NT_SUCCESS(Status) && StackDeallocationBase)
        {
            Size = 0;
            Status = NtFreeVirtualMemory(hProcess,
                &StackDeallocationBase,
                &Size,
                MEM_RELEASE);
        }
    }

    return Status;
}


The internals of RtlFreeUserStack are:

Code: Select all
NTSTATUS RtlFreeUserStack(
    PVOID StackDeallocationBase)
{
    SIZE_T Size;
    Size = 0;
    return NtFreeVirtualMemory(-1,
        &StackDeallocationBase,
        &Size,
        MEM_RELEASE);
}
nicklowe offline
Posts: 5

First unread post8 postsPage 1 of 1

Who is online

Users browsing this forum: No registered users and 1 guest