{"record":{"id":"d8c58907efa700b3","repo":"go-delve/delve","slug":"ntqueryinformationthread-failed-it-returns-0x-x","errorCode":null,"errorMessage":"NtQueryInformationThread failed: it returns 0x%x","messagePattern":"NtQueryInformationThread failed: it returns 0x%x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/native/threads_windows_amd64.go","lineNumber":29,"sourceCode":")\n\nfunc newContext() *winutil.AMD64CONTEXT {\n\treturn winutil.NewAMD64CONTEXT()\n}\n\nfunc registers(t *nativeThread) (proc.Registers, error) {\n\tcontext := newContext()\n\n\tcontext.SetFlags(_CONTEXT_ALL)\n\terr := t.getContext(context)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar threadInfo _THREAD_BASIC_INFORMATION\n\tstatus := _NtQueryInformationThread(t.os.hThread, _ThreadBasicInformation, &threadInfo, uint32(unsafe.Sizeof(threadInfo)), nil)\n\tif !_NT_SUCCESS(status) {\n\t\treturn nil, fmt.Errorf(\"NtQueryInformationThread failed: it returns 0x%x\", status)\n\t}\n\n\treturn winutil.NewAMD64Registers(context, uint64(threadInfo.TebBaseAddress)), nil\n}\n\nfunc (t *nativeThread) setContext(context *winutil.AMD64CONTEXT) error {\n\treturn _SetThreadContext(t.os.hThread, context)\n}\n\nfunc (t *nativeThread) getContext(context *winutil.AMD64CONTEXT) error {\n\treturn _GetThreadContext(t.os.hThread, context)\n}\n\nfunc (t *nativeThread) restoreRegisters(savedRegs proc.Registers) error {\n\treturn t.setContext(savedRegs.(*winutil.AMD64Registers).Context)\n}\n\nfunc (t *nativeThread) withDebugRegisters(f func(*amd64util.DebugRegisters) error) error {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/native/threads_windows_amd64.go#L11-L47","documentation":"Delve's native Windows backend calls NtQueryInformationThread with ThreadBasicInformation to obtain the thread's TEB base address when reading CPU registers. If the NT syscall returns a non-success NTSTATUS, the thread context cannot be assembled and an AMD64Registers object cannot be created. This typically means the thread handle is invalid, the thread has exited, or access rights are insufficient.","triggerScenarios":"Calling Registers() on a native Windows thread whose OS thread has exited between stop and register read, or whose hThread handle was opened without THREAD_QUERY_INFORMATION rights.","commonSituations":"Debugging a rapidly exiting thread (race between thread death and register read); attaching to a process with restricted privileges; antivirus/security software blocking handle access; reading registers of a dead thread in a multithreaded program.","solutions":["Retry the operation; transient races with thread exit usually resolve on a fresh stop state","Re-list threads and only read registers for threads still in the target's thread list","Run the debugger elevated (Administrator) to ensure sufficient handle access rights","Check for security software interfering with debugger handle permissions"],"exampleFix":"// before\nregs, err := thread.Registers()\n// after\nif !tg.HasThread(thread.ThreadID()) {\n    return nil // thread exited, skip\n}\nregs, err := thread.Registers()\nif err != nil {\n    if isDeadThread(err) { return nil }\n    return err\n}","handlingStrategy":"retry","validationCode":"if tg.HasThread(thread.ThreadID()) { /* safe to read registers */ }","typeGuard":"func threadAlive(t proc.Thread, tg *proc.TargetGroup) bool { return tg.HasThread(t.ThreadID()) }","tryCatchPattern":"regs, err := thread.Registers(); if err != nil { if strings.Contains(err.Error(), \"NtQueryInformationThread\") { /* thread likely exited; refresh thread list and retry once */ } else { return err } }","preventionTips":["Always refresh the thread list after each stop before reading registers","Run the debugger with elevated privileges on Windows","Skip register reads for threads absent from the target's thread list","Keep antivirus exclusions for your dev debugger tooling"],"tags":["windows","ptrace","registers","native-backend"],"backgroundTag":"ntsyscall-status-failure","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}