#ifndef _NTPSAPI_H
#if (PHNT_VERSION >= PHNT_WINDOWS_11)

/**
 * Changes the suspension state of a thread.
 *
 * \param ThreadStateChangeHandle A handle to the thread state change object.
 * \param ThreadHandle A handle to the thread.
 * \param StateChangeType The type of state change.
 * \param ExtendedInformation Optional extended information.
 * \param ExtendedInformationLength The length of the extended information.
 * \param Flags Suspension flags. Use zero for the basic contract; nonzero support is feature-dependent.
 * \return NTSTATUS Successful or errant status.
 * \remarks The state object must match ThreadHandle and grant access 0x1; ordinary transitions require
 * THREAD_SUSPEND_RESUME (0x2). Resume without a suspension tracked by this object returns
 * STATUS_INVALID_PARAMETER. Flags is consumed, not reserved: the feature-gated suspend path accepts bit 0x1 and 
 * parses 16-byte extended records, while other paths require zero. Use NULL/0/0 for the established basic contract; 
 * feature availability and extended-record semantics require separate validation.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtChangeThreadState(
    _In_ HANDLE ThreadStateChangeHandle,
    _In_ HANDLE ThreadHandle,
    _In_ THREAD_STATE_CHANGE_TYPE StateChangeType,
    _In_opt_ PTHREAD_STATE_CHANGE_EXT ExtendedInformation,
    _In_opt_ SIZE_T ExtendedInformationLength,
    _In_ ULONG Flags
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwChangeThreadState(
    _In_ HANDLE ThreadStateChangeHandle,
    _In_ HANDLE ThreadHandle,
    _In_ THREAD_STATE_CHANGE_TYPE StateChangeType,
    _In_opt_ PTHREAD_STATE_CHANGE_EXT ExtendedInformation,
    _In_opt_ SIZE_T ExtendedInformationLength,
    _In_ ULONG Flags
    );

#endif
View code on GitHub

NtDoc

Adjusts the state of a thread via a thread state object. This function offers a more resilient alternative mechanism to suspending threads, tying the duration of the operation to the lifetime of the state object.

Parameters

ThreadStateChangeHandle - a handle to the thread state object created via NtCreateThreadStateChange. The handle must grant THREAD_STATE_CHANGE_STATE access.
ThreadHandle - a handle to the associated thread which state should be changed. For suspend and resume operations, this handle must grant THREAD_SUSPEND_RESUME access.
StateChangeType - the type of the operation to perform.
ExtendedInformation - an optional pointer to a buffer with request-specific information. Currently unused.
ExtendedInformationLength - the size of the provided buffer. Currently unused.
Reserved - this parameter is unused and should be set to zero.

Operation types

For the list of supported operations, see THREAD_STATE_CHANGE_TYPE.

Remarks

Closing the thread state object handle via NtClose releases the reference. When the reference counter drops to zero, the system automatically undoes the effect of the state changes on the associated thread.

Related Win32 API

This functionality is not exposed in Win32 API.

Required OS version

This function was introduced in Windows 11.