Process Hacker Forums

Mon Nov 28, 2011 10:49 am

Reading the documentation for the TerminateThread says, that it will not cleanup the target thread's initial stack,....and afaik this is a leak. I found a function in ntdll.dll that has a interesting name: RtlFreeUserThreadStack(W2K) and RtlFreeUserStack(VISTA+),...is this the possible solution for this? It uses NtFreeVirtualMemory to free something pushing MEM_RELEASE (0x8000) on the stack before calling NtFreeVirtualMemory,...but what is freed and what are the two DWORD sized parameters it expects? Can someone tell me more about this please,... :thinking:

best

K.

Mon Nov 28, 2011 10:56 am

Since Vista the kernel frees the stack.

Mon Nov 28, 2011 11:06 am

wj32 wrote:
Since Vista the kernel frees the stack.

Ok, thats good to know. But what about windows 2000 and XP? There is a member on TEB named DeallocationStack of type PVOID referring to http://en.wikipedia.org/wiki/Thread_Environment_Block. Can this be used in some way?

Mon Nov 28, 2011 11:09 am

keremg wrote:
wj32 wrote:
Since Vista the kernel frees the stack.

Ok, thats good to know. But what about windows 2000 and XP? There is a member on TEB named DeallocationStack of type PVOID referring to http://en.wikipedia.org/wiki/Thread_Environment_Block. Can this be used in some way?

I'm not sure...

Mon Nov 28, 2011 2:57 pm

wj32 wrote:
keremg wrote:
wj32 wrote:
Since Vista the kernel frees the stack.

Ok, thats good to know. But what about windows 2000 and XP? There is a member on TEB named DeallocationStack of type PVOID referring to http://en.wikipedia.org/wiki/Thread_Environment_Block. Can this be used in some way?

I'm not sure...

Looks like simply terminating a thread seems not to be a good idea, there seem to be many more resources "orphaned" not just only stack memory,...

Thu Jan 05, 2012 6:28 pm

It is very possible to easily free user mode thread stacks under versions of Windows that otherwise leak them when they're forcefully terminated with a call to NTDLL's RtlFreeUserThreadStack().

I have just started a blog and made a post on this very issue explaining how to use it.

http://www.nicklowe.org/2012/01/thread-termination-dont-leak-the-stack/

Regards,

Nick

Sat Jan 07, 2012 5:30 am

nicklowe wrote:
It is very possible to easily free user mode thread stacks under versions of Windows that otherwise leak them when they're forcefully terminated with a call to NTDLL's RtlFreeUserThreadStack().

I have just started a blog and made a post on this very issue explaining how to use it.

http://www.nicklowe.org/2012/01/thread-termination-dont-leak-the-stack/

Regards,

Nick

Ok, thanks,...

Tue Jan 15, 2013 3:17 pm

Coming back to this thread a year later... The internals of RtlFreeUserThreadStack are:

NTSTATUS RtlFreeUserThreadStack(
    HANDLE hProcess,
    HANDLE hThread)
{
    NTSTATUS Status;
    PTEB Teb;
    THREAD_BASIC_INFORMATION ThreadInfo;
    PVOID StackDeallocationBase;
    ULONG Length;
    SIZE_T Size;
    Status = NtQueryInformationThread(hThread,
        ThreadBasicInformation,
        &ThreadInfo,
        sizeof(ThreadInfo),
        NULL);
    Teb = ThreadInfo.TebBaseAddress;
    if (NT_SUCCESS(Status) && Teb)
    {
        Status = NtReadVirtualMemory(hProcess,
            &Teb->DeallocationStack,
            &StackDeallocationBase,
            sizeof(StackDeallocationBase),
            &Length);
        if (NT_SUCCESS(Status) && StackDeallocationBase)
        {
            Size = 0;
            Status = NtFreeVirtualMemory(hProcess,
                &StackDeallocationBase,
                &Size,
                MEM_RELEASE);
        }
    }

    return Status;
}

The internals of RtlFreeUserStack are:

NTSTATUS RtlFreeUserStack(
    PVOID StackDeallocationBase)
{
    SIZE_T Size;
    Size = 0;
    return NtFreeVirtualMemory(-1,
        &StackDeallocationBase,
        &Size,
        MEM_RELEASE);
}

Process Hacker Forums

TerminateThread,...but what happens to thread stack?

TerminateThread,...but what happens to thread stack?

Re: TerminateThread,...but what happens to thread stack?

Re: TerminateThread,...but what happens to thread stack?

Re: TerminateThread,...but what happens to thread stack?

Re: TerminateThread,...but what happens to thread stack?

Re: TerminateThread,...but what happens to thread stack?

Re: TerminateThread,...but what happens to thread stack?

Re: TerminateThread,...but what happens to thread stack?

Who is online