| Previous | Next |
| STATUS_BAD_INITIAL_STACK | STATUS_INVALID_CID |
STATUS_BAD_INITIAL_PC
The native thread start address is invalid
A new thread needs an initial instruction address at which execution can begin. This status is specifically documented for an invalid initial start address supplied to native thread creation. It is not the same as the thread later faulting while executing a valid entry point.
Capture the raw start address, target process architecture and mapped-memory protection at creation time. For remote-thread scenarios, an address valid in the caller is not automatically valid in the target process. Also verify 32-bit versus 64-bit pointer width and that the image or executable mapping containing the entry point has not been unloaded.
What to inspect
- Record the exact start address and target process ID.
- Verify the address belongs to executable mapped memory in the target process.
- Check cross-architecture pointer truncation and module lifetime before retrying creation.
References
- Microsoft: CreateThread
- System Informer PHNT: process and thread Native API
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.