Is it possible to break on thread exit with specific error code?

Question

I was wondering if it was possible to configure visual studio 2008 debugger to stop execution when a thread exits with a precise error code (or at least any non-zero value). My

Answer 1

Yes, set a breakpoint in the function _RtlExitUserThread@4, and add a condition of *(int*)(ESP+4) == 42 to test if the exit status is a particular value (42, in this example); for 64-bit programs, use ESP+8 instead of ESP+4.

However, if the thread exited by returning from its main thread procedure (the usual case) instead of directly calling ExitThread or one of its wrappers, then you won't have any information about what thread it was or what caused it to exit other than the exit status and the thread ID.

Note: The function name _RtlExitUserThread@4 is an implementation detail that might change in future versions of Windows; _RtlExitUserThread@4 is the name on Windows 7. To find out what the actual is on your system, run dumpbin /exports C:\Windows\system32\kernel32.dll and look for the name that ExitThread maps to.