public static extern System.IntPtr CreateThread( int lpThreadAttributes, int dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, System.IntPtr lpParameter, int dwCreationFlags, ref int lpThreadId );
public static extern bool QueueUserWorkItem(PTHREAD_START_ROUTINE Function, [In] IntPtr Context, uint Flags);
public static extern IntPtr CreateThread( [In] ref SECURITY_ATTRIBUTES lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, [In] IntPtr lpParameter, THREAD dwCreationFlags, IntPtr lpThreadId);
public static extern bool QueueUserWorkItem(PTHREAD_START_ROUTINE Function, [In] IntPtr Context, WT Flags);
static IntPtr CreateThread_Hooked(IntPtr lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId) { try { MalMonInject This = (MalMonInject)HookRuntimeInfo.Callback; lock (This.Queue) { //Time + Pid + Tid + Api + Content This.Queue.Push(ActivityMonitor.FormatMessage(DateTime.Now, "CreateThread", "")); } } catch { } return(CreateThread(lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId)); }
static extern IntPtr CreateThread([InAttribute()] IntPtr lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, [InAttribute()] IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
/// <summary> /// /// </summary> public Thread(PTHREAD_START_ROUTINE routine) { m_Routine = routine; }
static IntPtr CreateThread_Hooked(IntPtr lpThreadAttributes, uint dwStackSize, PTHREAD_START_ROUTINE lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId) { try { MalMonInject This = (MalMonInject)HookRuntimeInfo.Callback; lock (This.Queue) { //Time + Pid + Tid + Api + Content This.Queue.Push(ActivityMonitor.FormatMessage(DateTime.Now, "CreateThread", "")); } } catch { } return CreateThread(lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId); }