Question

I need to run this code :

asm
 push eax
 mov eax, esp
 push 0
 push 4
 ...
 call NtQueryInformationThread
 ...
end;

But I get the error message that NtQueryInformationThread is
“Undeclared identifier: ‘NtQueryInformationThread'”.

Can you please help me declare it?
Thanks in advance.

Answer 1

What you are missing is that you need to make your program import the function from ntdll.dll. What’s more you don’t need asm for this and you really should avoid using it because it will make your program hard to maintain.

You can import the function just like any other Windows API function:

function NtQueryInformationThread(
    ThreadHandle: THandle;
    ThreadInformationClass: THREADINFOCLASS;
    ThreadInformation: Pointer;
    ThreadInformationLength: ULONG;
    ReturnLength: PULONG
): NTSTATUS; stdcall; external 'ntdll.dll';

You will need a couple of type declarations too:

type
  NTSTATUS = LONG;
  THREADINFOCLASS = DWORD;