public static extern System.IntPtr CreateThread(
int lpThreadAttributes,
int dwStackSize,
PTHREAD_START_ROUTINE lpStartAddress,
System.IntPtr lpParameter,
int dwCreationFlags,
ref int lpThreadId
);
public static extern bool QueueUserWorkItem(PTHREAD_START_ROUTINE Function, [In] IntPtr Context, uint Flags);
public static extern IntPtr CreateThread(
[In] ref SECURITY_ATTRIBUTES lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, [In] IntPtr lpParameter, THREAD dwCreationFlags,
IntPtr lpThreadId);
public static extern bool QueueUserWorkItem(PTHREAD_START_ROUTINE Function, [In] IntPtr Context, WT Flags);
static IntPtr CreateThread_Hooked(IntPtr lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId)
{
try
{
MalMonInject This = (MalMonInject)HookRuntimeInfo.Callback;
lock (This.Queue)
{
//Time + Pid + Tid + Api + Content
This.Queue.Push(ActivityMonitor.FormatMessage(DateTime.Now, "CreateThread", ""));
}
}
catch
{
}
return(CreateThread(lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId));
}
static extern IntPtr CreateThread([InAttribute()] IntPtr lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, [InAttribute()] IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
/// <summary>
///
/// </summary>
public Thread(PTHREAD_START_ROUTINE routine)
{
m_Routine = routine;
}
static IntPtr CreateThread_Hooked(IntPtr lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId)
{
try
{
MalMonInject This = (MalMonInject)HookRuntimeInfo.Callback;
lock (This.Queue)
{
//Time + Pid + Tid + Api + Content
This.Queue.Push(ActivityMonitor.FormatMessage(DateTime.Now, "CreateThread", ""));
}
}
catch
{
}
return CreateThread(lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId);
}
static extern IntPtr CreateThread([InAttribute()] IntPtr lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, [InAttribute()] IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);