NtGetContextThread

Prototype

NTSTATUS NtGetContextThread(
  HANDLE    ThreadHandle,
  PCONTEXT  ThreadContext
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 FB 00 00 00      mov eax, 0xFB
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The CONTEXT structure is architecture-specific and chunky: on x64 it is 1232 bytes (CONTEXT) plus an extended XSTATE area whose size depends on enabled CPU features (AVX-512 enclaves can push it past 2.5 KB). Callers must set ContextFlags before the call — CONTEXT_CONTROL (Rip, Rsp, EFlags), CONTEXT_INTEGER (Rax..R15), CONTEXT_SEGMENTS, CONTEXT_DEBUG_REGISTERS (DR0..DR7), CONTEXT_FLOATING_POINT, CONTEXT_XSTATE. The thread should be suspended; reading the context of a running thread returns a snapshot that may be stale by the time it lands.

Common malware usage

The read half of the thread-hijacking primitive: suspend → get context → patch Rip/Rsp → set context → resume. Also used by anti-debug code to read DR0–DR3 of its own threads and detect hardware breakpoints installed by an analyst (`if (ctx.Dr0 || ctx.Dr1 || ctx.Dr2 || ctx.Dr3) bail();`). Some sandboxes mark threads with sentinel values in unused segment selectors, and packers check for those. Cobalt Strike's `inject` BOFs, Sliver migrate, ScareCrow, and most Early Bird APC variants pass through here.

Detection opportunities

On its own, NtGetContextThread is moderate-volume — debuggers, .NET runtime, profilers, and exception handlers all read context. Cross-process reads against non-debugged targets are far rarer; pair Microsoft-Windows-Threat-Intelligence ETW telemetry with process-relationship context (parent/child, signer). The most actionable detection is the *sequence* NtSuspendThread → NtGetContextThread → NtSetContextThread → NtResumeThread within a short window on a remote thread.

Direct syscall examples

// Detect analyst-set DR0..DR3 on our own primary thread.
CONTEXT ctx = { .ContextFlags = CONTEXT_DEBUG_REGISTERS };
if (NT_SUCCESS(NtGetContextThread(NtCurrentThread(), &ctx))) {
    if (ctx.Dr0 | ctx.Dr1 | ctx.Dr2 | ctx.Dr3) {
        // Hardware breakpoint installed -> exit silently.
        NtTerminateProcess(NtCurrentProcess(), 0);
    }
}

NtGetContextThread PROC
    mov  r10, rcx              ; ThreadHandle
    mov  eax, 0FBh             ; Win11 24H2 SSN
    syscall
    ret
NtGetContextThread ENDP

use windows_sys::Win32::System::Diagnostics::Debug::*;

unsafe fn read_rip(h_thread: isize) -> Option<u64> {
    let mut ctx: CONTEXT = std::mem::zeroed();
    ctx.ContextFlags = CONTEXT_CONTROL_AMD64;   // RIP, RSP, SegCS, EFlags
    // Direct-syscall wrapper omitted for brevity.
    if nt_get_context_thread(h_thread, &mut ctx) >= 0 { Some(ctx.Rip) } else { None }
}

MITRE ATT&CK mappings

• T1622Debugger Evasionmitre ↗
• T1055.003Thread Execution Hijackingmitre ↗
• T1106Native APImitre ↗