cant open thraed in kernel mod - c++

Question

i developing kernel mod driver and i try to open thread with access with NtOpenThread
i start with ZwQuerySystemInformation with flag SystemProcessInformation
to run on all the runing process with this struct PSYSTEM_PROCESS_INFORMATION
i found the process that i look for
i get the pointer to the SYSTEM_THREAD_INFORMATION
and now i have all the running threads in the process
now i need to get the THREAD_BASIC_INFORMATION from NtQueryInformationThread
for this function i need to open thread with full access i try this code but no success
SYSTEM_THREAD_INFORMATION* st = spi->Threads;
HANDLE hThread;
OBJECT_ATTRIBUTES ObjectAttributes;
InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
NTSTATUS res = NtOpenThread(&hThread, MAXIMUM_ALLOWED, &ObjectAttributes, &st->ClientId);
if (!NT_SUCCESS(res)) {
return STATUS_UNSUCCESSFUL;
}
THREAD_BASIC_INFORMATIO info = { 0 };
durum = NtQueryInformationThread(hThread, ThreadBasicInformation, &info, sizeof(PTHREAD_BASIC_INFORMATIO), NULL);
DbgPrintEx(0, 0, "info->TebBaseAddress: %#010x", info.TebBaseAddress);
if (!info.TebBaseAddress > 0) {
return STATUS_UNSUCCESSFUL;
}
but the code never pass the NtOpenThread. i print the NTSTATUS res and i get 0xC0000005 and its mean
STATUS_ACCESS_VIOLATION
whyyy what worng??
i try to run this code on c++ exe and its work ok
DWORD pid = te.th32OwnerProcessID;//process id
DWORD tid = te.th32ThreadID;//thread id
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
if (hProcess == NULL)
{
int error = GetLastError();
cout << "OpenProcess error: " << error << endl;
}
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, false, tid);
if (hThread == NULL)
{
int error = GetLastError();
cout << "OpenThread error: " << error << endl;
}
HMODULE h = LoadLibrary(L"ntdll.dll");
fpNtQueryInformationThread NtQueryInformationThread = (fpNtQueryInformationThread)GetProcAddress(h, "NtQueryInformationThread");
THREAD_BASIC_INFORMATION info = { 0 };
NTSTATUS ret = NtQueryInformationThread(hThread, ThreadBasicInformation, &info, sizeof(THREAD_BASIC_INFORMATION), NULL);
printf("info->TebBaseAddress: %#010x\n", info.TebBaseAddress);
printf("info->UniqueProcess: %d\n", info.ClientId.UniqueProcess);
printf("info->UniqueThread: %d\n", info.ClientId.UniqueThread);
NT_TIB tib = { 0 };
if (!ReadProcessMemory(hProcess, info.TebBaseAddress, &tib, sizeof(NT_TIB), nullptr))
{
int error = GetLastError();
cout << "ReadProcessMemory error: " << error << endl;
}
printf("StackLimit: %#010x to StackBase: %#010x \n", tib.StackBase, tib.StackLimit);