On Tue Aug 15 13:21:04 2023 +0000, Jinoh Kang wrote:
No, I don't think so. How do you determine whether `NtTerminateThread()` actually terminated the thread on the spot, or just returned normally to `test_ntterminatethread_proc` which *in turn* returned to the system? There's nothing between `status = pNtTerminateThread(0, status);` and `return status;` that signals that the thread was still alive after the call. On the other hand, we *do* test that `NtTerminateProcess(0, 195);` returns to the caller without immediately terminating the process. See `dlls/kernel32/tests/loader.c` for details.
``` DWORD WINAPI test_ntterminatethread_proc( void *arg ) { DWORD status = (UINT_PTR)arg; status = pNtTerminateThread(0, status); return status; } ```
If arg == 0x1234 and NtTerminateProcess returns to the caller GetExitCodeThread status would be some other value than 0x1234 unless NtTerminateThread would return 0x1234 to the caller (which it does not).