public static Execute.Native.NTSTATUS NtCreateThreadEx( ref IntPtr threadHandle, Execute.Win32.WinNT.ACCESS_MASK desiredAccess, IntPtr objectAttributes, IntPtr processHandle, IntPtr startAddress, IntPtr parameter, bool createSuspended, int stackZeroBits, int sizeOfStack, int maximumStackSize, IntPtr attributeList) { // Craft an array for the arguments object[] funcargs = { threadHandle, desiredAccess, objectAttributes, processHandle, startAddress, parameter, createSuspended, stackZeroBits, sizeOfStack, maximumStackSize, attributeList }; Execute.Native.NTSTATUS retValue = (Execute.Native.NTSTATUS)Generic.DynamicAPIInvoke(@"ntdll.dll", @"NtCreateThreadEx", typeof(DELEGATES.NtCreateThreadEx), ref funcargs); // Update the modified variables threadHandle = (IntPtr)funcargs[0]; return(retValue); }
public static extern IntPtr NtCreateThreadEx( out IntPtr threadHandle, Execute.Win32.WinNT.ACCESS_MASK desiredAccess, IntPtr objectAttributes, IntPtr processHandle, IntPtr startAddress, IntPtr parameter, bool createSuspended, int stackZeroBits, int sizeOfStack, int maximumStackSize, IntPtr attributeList );