NtCreateThread - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTPSAPI_H
//
// Threads
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * Creates a new thread in the specified process.
 *
 * \param ThreadHandle A pointer to a handle that receives the thread object handle.
 * \param DesiredAccess The access rights desired for the thread object.
 * \param ObjectAttributes Optional. A pointer to an OBJECT_ATTRIBUTES structure that specifies the attributes of the new thread.
 * \param ProcessHandle A handle to the process in which the thread is to be created.
 * \param ClientId A pointer to a CLIENT_ID structure that receives the client ID of the new thread.
 * \param ThreadContext A pointer to a CONTEXT structure that specifies the initial context of the new thread.
 * \param InitialTeb A pointer to an INITIAL_TEB structure that specifies the initial stack limits of the new thread.
 * \param CreateSuspended If TRUE, the thread is created in a suspended state.
 * \return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateThread(
    _Out_ PHANDLE ThreadHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
    _In_ HANDLE ProcessHandle,
    _Out_ PCLIENT_ID ClientId,
    _In_ PCONTEXT ThreadContext,
    _In_ PINITIAL_TEB InitialTeb,
    _In_ BOOLEAN CreateSuspended
    );

#endif
#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateThread(
    _Out_ PHANDLE ThreadHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
    _In_ HANDLE ProcessHandle,
    _Out_ PCLIENT_ID ClientId,
    _In_ PCONTEXT ThreadContext,
    _In_ PINITIAL_TEB InitialTeb,
    _In_ BOOLEAN CreateSuspended
    );

#endif

View code on GitHub

NtDoc

Creates a new thread in the specified process. This is a legacy function that requires manually allocating stack and preparing thread context.

Parameters

Remarks

For the modern equivalent, see NtCreateThreadEx.

To avoid retaining unused resources, call NtClose to close the returned handle when it is no longer required.

Related Win32 API

This functionality is not exposed in Win32 API. The closest alternative that uses the modern syscall is CreateRemoteThreadEx.

See also

NTinternals.net (undocumented.ntinternals.net)

ThreadHandle

Caller supplied storage for the resulting handle.

DesiredAccess

Specifies the allowed or desired access to the thread.

ObjectAttributes

Initialized attributes for the object.

ProcessHandle

Handle to the threads parent process.

ClientId

Caller supplies storage for returned process id and thread id.

ThreadContext

Initial processor context for the thread.

InitialTeb

Initial user mode stack context for the thread.

CreateSuspended

Specifies if the thread is ready for scheduling. See NtContinue for more information.

Documented by

See also