DIP Hook | NtCreateThreadEx

Yes they can easily scan for any modification to the code section ( and they do in the main executable - however idk about anything else as I haven't checked )

No NtCreateThreadEx is not part of windows XP. NtCreateThread is but you need to use RtlCreateUserStack and then RtlInitializeContext and THEN call NtCreateThread ( and you can do all of this manually including the system call )
Besides XP is so old it shouldn't be supported at this point anyways.
P.s. I assumed you're talking about NtCreateThreadEx because it's what's used in this hook and not NtCreateThread.
Which are two completely different kernel routines. Also of course they're in different locations you moron.. functions get added and removed with each release of windows.. Even the ordinals change most of the time.

Yes, i realize. In my hacks I wouldn't support XP anyways, because like you said, it's old. I know ntdll is stored under different locations in the different operating systems. Windows Vista and newer store ntdll under the kernelbase, as XP does not. I didn't know that NtCreateThreadEx was not part of windows XP, mainly because I have never even used windows XP.

...No it's not. It's in system32 / syswow64 ( depending on if you're loading the x86_64 or x86_32 one )
ntdll is always the first module loaded followed by kernel32 which is always the second and then the main executable which is always third.
ntdll and kernel32 have to be loaded at their preferred base address.
Everything else works from those modules upwards. KernelBase is a stripped version of kernel32 that's within kernel32.dll's import table.
It's part of the MinWIN project that was started by Mark Russinovich. & They've slowly been peeling back unneeded parts of the OS since. Which is why windows 8 & 10 boot so fast as they removed a lot of the old parts of the system that wasn't needed anymore. MinWIN started development around vista IIRC although wasn't actually implemented until windows 8 IIRC. Anyways.. if you don't know what you're talking about I suggest you just keep your mouth shut. There's enough misinformation out there as it is.

Guess I found some of the misinformation you are talking about. I found a Chinese page claiming NtDll is store in Kernel32 in winXP and stored in the KernelBase which is in the Kernel32 in WinXP later. I can even link you the page if you would like. I thought I knew what I was talking about, so before you go correcting me in that way, just know that MPGH is the place for noobs to ask questions and say what they want to say. Its a community, not just you.

Edit: Lol didn't realize how many people you have been a 8===D to on this post XD Even mamo said something

Which is why I corrected your misinformation so the people reading this post wouldn't be misinformed, deal with it.

I'm nice to noobs as long as they're not spreading misinformation. Asking questions is fine, spreading misinformation is not.

Noob: A person who is inexperienced in a particular sphere or activity, especially computing or the use of the Internet.
Noun: Informal

Noobs aren't pros, so unless their ABSOLUTELY CERTAIN, they are only allowed to ask questions? And if they say something they aren't support to your going to bark at them? Anyways, I didn't spread misinformation. All I said was, I know how to do this so that it works in Windows XP, which i do. If your talking about me saying NtDll is stored in a different location, so f'n what.

Don't put words in my mouth you prick. I don't care what noobs do as long as they're not spreading misinformation which you were doing. This also applies to non-noobs too. I'm just explaining why you're wrong. If you can't handle being wrong then go read some books on the subject so next time you won't be. Also like I said before you can't use NtCreateThreadEx in xp only vista+ on xp you have to manually setup a thread stack, initialize all the segments and reigsters, etc (the threads context), and then from there you set the IP to a function that calls the thread routine with the optional parameter and then wait on the return and terminate the thread. NtCreateThread & RtlCreateUserStack & RtlInitializeContext is what's used by the kernel in xp

Here's my most respected members here on this forum. I truly loved the way you response on a very detailed information. I hope that sooner or later.. if you have some spare or even a little bit of time pls get back on the hacking stuffs business.

If anyone is wondering, NtCreateThread is part of ntdll.dll. And it works for Windows XP but its location is not the same. There's a way to do this that works for Windows XP too :P

What about that is misinformation? NtCreateThreadEx is part of NtDll, Their not in same location, mainly because yes it doesn't exsist in windows xp. and there is a way to do this in windows xp..... what in the hell am i lieing about, me knowing the way?

If anyone even cared about my misinformation, they could easily look it up, or open ollydbg or ida, which tell you the paths right off the bat -.- Your right, I have better things to do too, and yes, better than studying paths of dlls. Never used, never planning to use Windows XP, so I dont give a damn about it. SORRY