26.远程线程

Notes #滴水基础_Win32 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
A:
#include <stdio.h>
#include "Windows.h"

void Fun() {
	for (int i = 0; i < 10; i++)
	{
		Sleep(1000);
		printf("Running...\n");
	}
}

DWORD WINAPI ThreadProc(LPVOID lpParameter) {
	Fun();
	return 0;
}

int main() {
	HANDLE hThread =  CreateThread(NULL, 0, ThreadProc, NULL, 0, NULL);
	CloseHandle(hThread);
	getchar();
	return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
B:
#include <windows.h>


BOOL MyCreateRemoteThread(DWORD dwProcessID, FARPROC dwProcAddr) {
    HANDLE hProcess;
    HANDLE hThread;
    DWORD dwThreadID;
    //获取进程句柄
    hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID);

    if (hProcess == NULL) {
        OutputDebugString("OpenProcess Error! \n");
        return FALSE;
    }
    //创建远程线程
    hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)dwProcAddr, NULL, 0, &dwThreadID);

    if (hThread == NULL) {
        OutputDebugString("CreateRemoteThread Error! \n");
        CloseHandle(hProcess);
        return FALSE;
    }

    CloseHandle(hThread);
    CloseHandle(hProcess);
    return TRUE;
}

int main(void) {
    //PID,目标进程中的函数地址
    MyCreateRemoteThread(18476, (FARPROC)0x07FF754CF1070);

	return 0;
}

关于本文

由 GuQing 撰写，采用 CC BY-NC 4.0 许可协议。