Yes, set a breakpoint in the function _RtlExitUserThread@4
, and add a condition of *(int*)(ESP+4) == 42
to test if the exit status is a particular value (42, in this example); for 64-bit programs, use ESP+8
instead of ESP+4
.
However, if the thread exited by returning from its main thread procedure (the usual case) instead of directly calling ExitThread
or one of its wrappers, then you won't have any information about what thread it was or what caused it to exit other than the exit status and the thread ID.
Note: The function name _RtlExitUserThread@4
is an implementation detail that might change in future versions of Windows; _RtlExitUserThread@4
is the name on Windows 7. To find out what the actual is on your system, run dumpbin /exports C:\Windows\system32\kernel32.dll
and look for the name that ExitThread
maps to.