Yes, set a breakpoint in the _RtlExitUserThread@4 function and add the condition *(int*)(ESP+4) == 42 to check if the exit status is a specific value (42 in this example); for 64-bit programs, use ESP+8 instead of ESP+4 .
However, if the thread completed the return from its main thread procedure (normal case) instead of directly calling ExitThread or one of its shells, then you will not have any information about what it was or what caused it to exit, except for the exit status and identifier flow.
Note. The function name _RtlExitUserThread@4 is an implementation detail that may change in future versions of Windows; _RtlExitUserThread@4 is the name on Windows 7. To find out what is actually on your system, run dumpbin /exports C:\Windows\system32\kernel32.dll and find the name that ExitThread bound ExitThread .
Adam rosenfield
source share