title: Python - Ctype.windll.kernel32.CreateThread Parameter value
body: <p>this might be a really simple question, but somehow I just cannot wrap my head around the answer, and I cannot find any good and related documentations on such topic either.  </p>
  
  <p>So I am attempting to do a PoC using Python's ctypes module and the CreateThread method within ctypes.windll.kernel32 class (to do some shellcode injection within a program's memory space)</p>
  
  <p>According to msdn documentation<a href="https://msdn.microsoft.com/en-us/library/windows/desktop/ms682453(v=vs.85).aspx" rel="nofollow noreferrer">CreateThread</a>The 7 parameters are: </p>
  
  <ul>
  <li>Pointer to Security Attributes  </li>
  <li>Initial Stack Size</li>
  <li>Pointer to Start Address</li>
  <li>Pointer to any parameters</li>
  <li>Creation Flag</li>
  <li>Pointer to a value that receives the thread identifier</li>
  </ul>
  
  <p>And all the examples of using python to call c style functions and libs are as such: </p>
  
  <pre><code>thread_handle = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
                  ctypes.c_int(0),
                  ctypes.c_int(ptr),
                  ctypes.c_int(0),
                  ctypes.c_int(0),
                  ctypes.pointer(ctypes.c_int(0)))
  </code></pre>
  
  <p>Can someone please explain why the last parameter was used as ctypes.pointer(c_int0), while the other null pointer's constant value of integer 0 is used for the other parameters. (eg. ctypes.c_int(0))</p>
  
  <p><strong>Update: Here is a sample code, and this implementation can be seen all over the net:</strong> </p>
  
  <p>Line 786 of <a href="https://github.com/wetw0rk/Sickle/blob/master/sickle.py" rel="nofollow noreferrer">createThread function call in python</a></p>
  
  <p>Note at the line of the script linked above, the comments mentioned:</p>
  
  <pre><code>  #   _Out_opt_ LPDWORD  lpThreadId  // NULL, so the thread identifier is not returned.
  </code></pre>
  
  <p>It looks like the author might be wrong when commenting the reference for the CreateThread function call. </p>
  
  <p><strong>Assumption:</strong>
  As per the comment in Mark's answer mentioned, the ThreadID and the ThreadHandle are different, and by passing in a ctypes.pointer(ctypes.c_int(0)) instead of just plain ctypes.c_int(0) (NULL) means that at the int 0 location, will store the thread ID. Can someone confirm this assumption?</p>