ZwQueryInformationThread(ThreadLastSystemCall)

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
//You can use this method to retrieve the last system call issued by a specific thread.
#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

#define ThreadLastSystemCall            0x15

extern "C"
{
int __stdcall ZwSetInformationThread(HANDLE,unsigned long,unsigned long*,unsigned long);
int __stdcall ZwQueryInformationThread(HANDLE,unsigned long,unsigned long*,unsigned long,unsigned long*);
}

void Wait()
{
    MessageBox(0,"Waliedassar","waliedassar",0);
    //Sleep(INFINITE);
    return;
}


struct ThreadLastSysCallInfo
{
    unsigned long FirstArgument;
    unsigned short SysCallNumber;
    unsigned short pad;
};

int main(int argc, char* argv[])
{

    unsigned long tid=0;
    HANDLE hT=CreateThread(0,0x1000,(LPTHREAD_START_ROUTINE)&Wait,0,0,&tid);
    if(!hT) return 0;
    Sleep(1000);

    unsigned long length=0;
    ThreadLastSysCallInfo LASTCALL={0};
    int ret=ZwQueryInformationThread(hT,ThreadLastSystemCall,(unsigned long*)(&LASTCALL),0x8,&length);
    if(ret>=0)
    {
        printf("Okay\r\n");
        printf("First argument is %x\r\n",LASTCALL.FirstArgument); //FirstArgument
        printf("Last System call is %x\r\n",LASTCALL.SysCallNumber); //Syscall ordinal
    }
    else       printf("Error: %x\r\n",ret);
    return 0;
}