/// <summary>
/// Creates a thread that runs in the remote process.
/// </summary>
/// <param name="address">
/// A pointer to the application-defined function to be executed by the thread and represents
/// the starting address of the thread in the remote process.
/// </param>
/// <param name="isStarted">Sets if the thread must be started just after being created.</param>
/// <returns>A new instance of the <see cref="ARemoteThread" /> class.</returns>
public IARemoteThread Create(IntPtr address, bool isStarted = true)
{
//Create the thread
var ret = AThreadHelper.NtQueryInformationThread(
AThreadHelper.CreateRemoteThread(Process.Handle, address, IntPtr.Zero, ThreadCreationFlags.Suspended));
// Find the managed object corresponding to this thread
// todo should thread id be an intpr?
var result = new ARemoteThread(Process, Process.ThreadFactory.NativeThreads.First(t => t.Id == ret.ClientId.UniqueThread.ToInt32()));
// If the thread must be started
if (isStarted)
{
result.Resume();
}
return(result);
}
/// <summary>
/// Creates a thread that runs in the remote process.
/// </summary>
/// <param name="address">
/// A pointer to the application-defined function to be executed by the thread and represents
/// the starting address of the thread in the remote process.
/// </param>
/// <param name="parameter">A variable to be passed to the thread function.</param>
/// <param name="isStarted">Sets if the thread must be started just after being created.</param>
/// <returns>A new instance of the <see cref="ARemoteThread" /> class.</returns>
public IARemoteThread Create(IntPtr address, dynamic parameter, bool isStarted = true)
{
// Marshal the parameter
var marshalledParameter = AMarshalValue.Marshal(Process, parameter);
//Create the thread
var ret = AThreadHelper.NtQueryInformationThread(
AThreadHelper.CreateRemoteThread(Process.Handle, address, marshalledParameter.Reference,
ThreadCreationFlags.Suspended));
// Find the managed object corresponding to this thread
var result = new ARemoteThread(Process, Process.ThreadFactory.NativeThreads.First(t => t.Id == ret.ThreadId),
marshalledParameter);
if (isStarted)
{
result.Resume();
}
return(result);
}
