CreateRemoteThread 做什么来实际创建远程线程?
2 回答
Inside the kernel, the lowest level thread creation function is really just creating a thread object, connecting it to a process and making it runnable. CreateThread and CreateRemoteThread are really the same API and work the same way, the only difference being that CreateThread only allows you to create a thread in the current process while CreateRemoteThread allows you to specify a process to create a thread in.
This means that CreateThread is pretty much the same as CreateRemoteThread(GetCurrentProcess(), ....)
It calls NtCreateThreadEx, which is a kernel call.