CreateRemoteThread
The CreateRemoteThread
function creates a thread that runs in the address space of another process.
HANDLE CreateRemoteThread(
|
HANDLE hProcess, |
// handle to
process to create thread in |
|
LPSECURITY_ATTRIBUTES lpThreadAttributes, |
// pointer to
thread security attributes |
|
DWORD dwStackSize, |
// initial thread
stack size, in bytes |
|
LPTHREAD_START_ROUTINE lpStartAddress, |
// pointer to thread
function |
|
LPVOID lpParameter, |
// pointer to
argument for new thread |
|
DWORD dwCreationFlags, |
// creation flags |
|
LPDWORD lpThreadId |
// pointer to
returned thread identifier |
|
); |
|
Parameters
hProcess
Identifies
the process in which the thread is to be created.
Windows
NT: The handle must have
PROCESS_CREATE_THREAD access. For more information, see Process Objects.
lpThreadAttributes
Pointer to a SECURITY_ATTRIBUTES structure that specifies a
security descriptor for the new thread and determines whether child processes
can inherit the returned handle. If lpThreadAttributes is NULL, the
thread gets a default security descriptor and the handle cannot be inherited.
dwStackSize
Specifies the
size, in bytes, of the stack for the new thread. If this value is zero, the
stack size defaults to the same size as that of the primary thread of the
process. The stack is allocated automatically in the memory space of the
process and is freed when the thread terminates. Note that the stack size grows
as necessary.
lpStartAddress
Points to the
starting address of the new thread. This is typically the address of a function
declared with the WINAPI calling convention that never returns and that accepts
a single 32-bit pointer as an argument.
lpParameter
Points to a
single 32-bit value passed to the thread.
dwCreationFlags
Specifies
additional flags that control the creation of the thread. If the
CREATE_SUSPENDED flag is specified, the thread is created in a suspended state
and will not run until the ResumeThread function is called. If this value is zero, the
thread runs immediately after creation.
lpThreadId
Points to a
32-bit variable that receives the thread identifier.
Return Values
If the function
succeeds, the return value is a handle to the new thread.
If the
function fails, the return value is NULL. To get extended error information,
call GetLastError.
Remarks
The CreateRemoteThread
function causes a new thread of execution to begin in the address space of the
specified process. The thread has access to all objects opened by the process.
The new
thread handle is created with full access to the new thread. If a security
descriptor is not provided, the handle may be used in any function that
requires a thread object handle. When a security descriptor is provided, an
access check is performed on all subsequent uses of the handle before access is
granted. If the access check denies access, the requesting process cannot use
the handle to gain access to the thread.
The thread
execution begins at the function specified by the lpStartAddress
parameter. If this function returns, the results are unspecified.
CreateRemoteThread may succeed even if lpStartAddress points to
data, code, or is not accessible. If the start address is invalid when the
thread runs, an exception occurs, and the thread terminates. Thread termination
due to a invalid start address is handled as an error exit for the thread s
process. This behavior is similar to the asynchronous nature of CreateProcess,
where the process is created even if it refers to invalid or missing
dynamic-link libraries (DLLs).
The thread is
created with a thread priority of THREAD_PRIORITY_NORMAL. Use the GetThreadPriority and SetThreadPriority functions to get and set
the priority value of a thread.
When a thread
terminates, the thread object attains a signaled state, satisfying any threads
that were waiting for the object.
The thread
object remains in the system until the thread has terminated and all handles to
it have been closed through a call to CloseHandle.
The ExitProcess,
ExitThread, CreateThread, CreateRemoteThread functions,
and a process that is starting (as the result of a CreateProcess call)
are serialized between each other within a process. Only one of these events
can happen in an address space at a time. This means the following restrictions
hold:
During process startup and DLL
initialization routines, new threads can be created, but they do not begin
execution until DLL initialization is done for the process.
Only one thread in a process
can be in a DLL initialization or detach routine at a time.
ExitProcess does not
return until no threads are in their DLL initialization or detach routines.
See Also