jattach icon indicating copy to clipboard operation
jattach copied to clipboard

In the Windows Server 2008 R2 environment, when the scheduled task(schtasks.exe) uses the SYSTEM user startup program to call jattach, an error Could not create remote thread (error code = 8) is reported.

Open lijhnihaoa opened this issue 1 year ago • 2 comments

OS: windows server 2008 R2

In the golang program, os.Exec() calls jattach.exe to perform {pid} load instrument false xxxxx, and then the golang process is compiled into zeus.exe. Use schtasks.exe to create a scheduled task and call zeus.exe once every minute schtasks /create /tn "task1" /tr "\"%zeus_exe_path%\" --backend-url %backend_url% --cid %cid%" /sc minute /mo 1 /ru "NT AUTHORITY\SYSTEM" /f Log error: Could not create remote thread (error code = 8) However, if you use the administrator user, no error will be reported; only taskgent.exe will pop up every time the scheduled task is called.

lijhnihaoa avatar Jan 20 '25 01:01 lijhnihaoa

Thank you for the report. We will try to investigate the issue basing on the data provided.

apangin avatar Jan 20 '25 23:01 apangin

Looking forward to your good news.

lijhnihaoa avatar Jan 23 '25 03:01 lijhnihaoa