Create a remote thread in a suspended process

Create a process in a pending state

CreateProcess create_suspended, NULL, NULL, addr @si, addr @pi

Create a remote thread in the process

CreateRemoteThread 0, eax, NULL, NULL, NULL

If the remote thread exits before the main thread is resumed, the program exits or there is no interface (this is the problem under XP and WIN7 does not appear).

Access to a variety of information, mainly the following two kinds of views:

1) Some people say that the remote thread may have called some APIs, and the process was created in a suspended state and not initialized, so there would be a problem, tested,

This argument is incorrect, and when you start a remote thread, the process loads all modules and initializes normally.

2) Others say that the process was created in a suspended state, and when the remote thread is executed, the process takes the remote thread as its "main thread", initializes the environment for it,

If there is no main thread of the recovery process before exiting the remote thread, then the system will assume that the "main thread" of the process exits, and that no other threads are running.

The process also does not exist, tested, this statement is correct. So the workaround is to call sleep in the remote thread, and then exit after the main thread of the process resumes .

Create a remote thread in a suspended process