| 术语 | createremotethread |
| 释义 | CreateRemoteThread 语法： C++ HANDLE WINAPI CreateRemoteThread( __in HANDLE hProcess, __in LPSECURITY_ATTRIBUTES lpThreadAttributes, __in SIZE_T dwStackSize, __in LPTHREAD_START_ROUTINE lpStartAddress, __in LPVOID lpParameter, __in DWORD dwCreationFlags, __out LPDWORD lpThreadId ); CreateRemoteThread的功能 创建一个线程运行在另一进程的虚拟地址空间。 使用CreateRemoteThreadEx函数来创建一个线程，在另一个处理器的虚拟地址空间运行，并选择指定扩展属性。 参数 hProcess [in] 句柄的进程中，线程被创建。句柄必须有PROCESS_CREATE_THREAD，PROCESS_QUERY_INFORMATION，PROCESS_VM_OPERATION，PROCESS_VM_WRITE和PROCESS_VM_READ访问权限，可能无法在某些平台上没有这些权利。有关更多信息，请参见过程的安全性和访问权限。 lpThreadAttributes [in] 一个 SECURITY_ATTRIBUTES结构，指定新的线程安全描述符，并决定是否可以继承子进程返回的句柄的指针。如果lpThreadAttributes为NULL，线程获得一个默认的安全描述和处理不能被继承。访问控制列表(ACL)在为来自线程默认安全描述符的主要创造者的象征。 Windows XP/2000操作系统：在对来自线程默认安全描述符的ACL或模拟的主要创造者的象征。与Windows SP2和Windows Server 2003的XP的改变了这种行为。 dwStackSize [in] 堆栈以字节为单位的初始大小。该系统四轮到最近的网页的价值。如果此参数为0(零)，新线程使用的可执行文件的默认大小。有关更多信息，请参见线程堆栈大小。 lpStartAddress [in] 该申请的指针定义的类型的功能LPTHREAD_START_ROUTINE被执行的线程，并代表了在远程进程中的线程的起始地址。函数必须存在于远程进程。有关更多信息，请参阅ThreadProc。 lpParameter [in] 对变量的指针传递给线程函数。 dwCreationFlags [in] 这些标志来控制创建线程。 ValueMeaning 0The线程创建后立即运行。 CREATE_SUSPENDED 0x00000004The线程创建处于挂起状态，并不直到ResumeThread函数被调用运行。 STACK_SIZE_PARAM_IS_A_RESERVATION 0x00010000The dwStackSize参数指定堆栈的初始储备规模。如果此标志没有被指定，dwStackSize指定提交的大小。 视窗2000：STACK_SIZE_PARAM_IS_A_RESERVATION标志不支持。 lpThreadId [输出] 一个变量，它接收线程标识符的指针。 如果该参数为NULL，线程标识符不返回。 返回值 如果函数成功，返回值是一个句柄新线程。 如果函数失败，返回值为NULL。为了获得更多错误信息，调用GetLastError。 请注意，CreateRemoteThread的可能成功，即使lpStartAddress点的数据，代码，或无法访问。如果起始地址是无效的线程运行时，就会发生异常，以及线程终止。线程终止由于起始地址是无效的处理作为线程的进程的错误退出。此行为是类似于CreateProcess的，异步的性质在创建的过程，即使它是指无效或丢失的动态链接库(DLL)。 备注 该CreateRemoteThread的功能，当新的执行线程，开始在指定的进程的地址空间。该线程可以访问所有对象的进程打开。 终端服务分离的设计，每个终端会话。因此，CreateRemoteThread的失败如果目标进程在不同的会议比调用进程。 新创建的线程句柄是充分利用新的线程。如果一个安全描述符是没有提供的处理，可用于任何功能，需要一个线程对象句柄。当提供安全描述符，访问检查，是对前处理授予访问权限执行的所有后续用途。如果访问检查拒绝访问，请求进程不能使用句柄来访问线程。 该线程是创建一个THREAD_PRIORITY_NORMAL线程优先级。使用GetThreadPriority和SetThreadPriority函数来获取和设置线程的优先级值。 当一个线程终止时，该线程对象年满信号状态，它满足线程对象为等待。 线程对象的系统中仍然有效，直到该线程终止，所有句柄给它是通过一个封闭的CloseHandle调用。 PRB：ExitProcess期间，ExitThread，CreateThread，CreateRemoteThread的功能，这一过程已经开始(作为一个调用CreateProcess的结果)是序列彼此之间在一个过程。只有对这些事件之一发生在一次在一个地址空间。这意味着持有下列限制： 在进程启动和DLL初始化例程，新的线程可以被创建，但他们没有开始执行，直到DLL初始化是完成这一进程。 只有一个线程在一个进程可以在DLL初始化或分离一次例行。 毕竟PRB：ExitProcess期间完成了线程DLL初始化例程或分离的回报。 这一功能常见的用途是注入正在调试发出中断进程线程。但是，这不推荐使用，因为额外的线程混乱的人调试应用程序和有多种副作用，使用这种技术： 它转换单线程应用为多线程应用。 它改变了时间和记忆过程的布局。 在调用它的结果到每个在这个过程中DLL入口点。 这个函数的另一个常见用途是注入查询堆或其他处理信息的过程一个线程。这可能会导致相同的副作用上段提及。此外，应用程序可以死锁如果线程试图获得所有权的锁，另一个线程使用。 要求： 最低支持：client－Windows 2000专业版 最低支持server－Windows 2000服务器 HeaderWinbase.h(头文件：winuser.h) LibraryKernel32.lib DLLKernel32.dll 参见 CloseHandle CreateProcess的 CreateRemoteThreadEx CreateThread PRB：ExitProcess期间 ExitThread GetThreadPriority 进程和线程函数 ResumeThread SECURITY_ATTRIBUTES SetThreadPriority ThreadProc 主题 如果有任何问题和意见，请发送给微软(wsddocfb@microsoft.com) 生成日期：2009年8月27日 ＝＝英文原文＝＝CreateRemoteThread Function Creates a thread that runs in the virtual address space of another process. Use the CreateRemoteThreadEx function to create a thread that runs in the virtual address space of another processor and optionally specify extended attributes. Syntax C++ HANDLE WINAPI CreateRemoteThread( __in HANDLE hProcess, __in LPSECURITY_ATTRIBUTES lpThreadAttributes, __in SIZE_T dwStackSize, __in LPTHREAD_START_ROUTINE lpStartAddress, __in LPVOID lpParameter, __in DWORD dwCreationFlags, __out LPDWORD lpThreadId ); Parameters hProcess [in] A handle to the process in which the thread is to be created. The handle must have the PROCESS_CREATE_THREAD, PROCESS_QUERY_INFORMATION, PROCESS_VM_OPERATION, PROCESS_VM_WRITE, and PROCESS_VM_READ access rights, and may fail without these rights on certain platforms. For more information, see Process Security and Access Rights . lpThreadAttributes [in] A pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new thread and determines whether child processes can inherit the returned handle. If lpThreadAttributes is NULL, the thread gets a default security descriptor and the handle cannot be inherited. The access control lists (ACL) in the default security descriptor for a thread come from the primary token of the creator. Windows XP/2000: The ACLs in the default security descriptor for a thread come from the primary or impersonation token of the creator. This behavior changed with Windows XP with SP2 and Windows Server 2003. dwStackSize [in] The initial size of the stack, in bytes. The system rounds this value to the nearest page. If this parameter is 0 (zero), the new thread uses the default size for the executable. For more information, see Thread Stack Size . lpStartAddress [in] A pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. For more information, see ThreadProc . lpParameter [in] A pointer to a variable to be passed to the thread function. dwCreationFlags [in] The flags that control the creation of the thread. ValueMeaning 0The thread runs immediately after creation. CREATE_SUSPENDED 0x00000004The thread is created in a suspended state, and does not run until the ResumeThread function is called. STACK_SIZE_PARAM_IS_A_RESERVATION 0x00010000The dwStackSize parameter specifies the initial reserve size of the stack. If this flag is not specified, dwStackSize specifies the commit size. Windows 2000: The STACK_SIZE_PARAM_IS_A_RESERVATION flag is not supported. lpThreadId [out] A pointer to a variable that receives the thread identifier. If this parameter is NULL, the thread identifier is not returned. Return Value If the function succeeds, the return value is a handle to the new thread. If the function fails, the return value is NULL. To get extended error information, call GetLastError . Note that CreateRemoteThread may succeed even if lpStartAddress points to data, code, or is not accessible. If the start address is invalid when the thread runs, an exception occurs, and the thread terminates. Thread termination due to a invalid start address is handled as an error exit for the thread's process. This behavior is similar to the asynchronous nature of CreateProcess , where the process is created even if it refers to invalid or missing dynamic-link libraries (DLL). Remarks The CreateRemoteThread function causes a new thread of execution to begin in the address space of the specified process. The thread has access to all objects that the process opens. Terminal Services isolates each terminal session by design. Therefore, CreateRemoteThread fails if the target process is in a different session than the calling process. The new thread handle is created with full access to the new thread. If a security descriptor is not provided, the handle may be used in any function that requires a thread object handle. When a security descriptor is provided, an access check is performed on all subsequent uses of the handle before access is granted. If the access check denies access, the requesting process cannot use the handle to gain access to the thread. The thread is created with a thread priority of THREAD_PRIORITY_NORMAL. Use the GetThreadPriority and SetThreadPriority functions to get and set the priority value of a thread. When a thread terminates, the thread object attains a signaled state, which satisfies the threads that are waiting for the object. The thread object remains in the system until the thread has terminated and all handles to it are closed through a call to CloseHandle . The ExitProcess , ExitThread , CreateThread , CreateRemoteThread functions, and a process that is starting (as the result of a CreateProcess call) are serialized between each other within a process. Only one of these events occurs in an address space at a time. This means the following restrictions hold: During process startup and DLL initialization routines, new threads can be created, but they do not begin execution until DLL initialization is done for the process. Only one thread in a process can be in a DLL initialization or detach routine at a time. ExitProcess returns after all threads have completed their DLL initialization or detach routines. A common use of this function is to inject a thread into a process that is being debugged to issue a break. However, this use is not recommended, because the extra thread is confusing to the person debugging the application and there are several side effects to using this technique: It converts single-threaded applications into multi-threaded applications. It changes the timing and memory layout of the process. It results in a call to the entry point of each DLL in the process. Another common use of this function is to inject a thread into a process to query heap or other process information. This can cause the same side effects mentioned in the previous paragraph. Also, the application can deadlock if the thread attempts to obtain ownership of locks that another thread is using. Requirements Minimum supported clientWindows 2000 Professional Minimum supported serverWindows 2000 Server HeaderWinbase.h (include Windows.h) LibraryKernel32.lib DLLKernel32.dll See Also CloseHandle CreateProcess CreateRemoteThreadEx CreateThread ExitProcess ExitThread GetThreadPriority Process and Thread Functions ResumeThread SECURITY_ATTRIBUTES SetThreadPriority ThreadProc Threads Send comments about this topic to Microsoft Build date: 8/27/2009 ＝＝原始网址＝＝http://msdn.microsoft.com/en-us/library/ms682437(VS.85).aspx\n |
| 随便看 |
|
windows api函数参考手册包含2258条windows api函数文档，详细介绍nodejs、java、rust调用windows api的方法技巧，是学习windows api编程的入门中文文档。