A forum for reverse engineering, OS internals and malware analysis
Tigzy wrote:you're right the variable must be destroyed at the end of the function...Which "variable must be destroyed at the end of the function"? If you will move it (the struct) to global you don't need to do anything, but if you will allocate a chunk of kernel pool, than yes, you will need to free (somewhere) this memory. I don't see in the code you've posted calling of ZwClose for thread handle and PsTerminateSystemThread called from inside of thread routine (see documentation), proper initialization of ObjectAttributes (depending on process context).
