| 195 | } |
| 196 | |
| 197 | HANDLE DllInjection::customCreateRemoteThread(HANDLE hProcess, LPVOID lpStartAddress, LPVOID lpParameter) |
| 198 | { |
| 199 | DWORD lpThreadId = 0; |
| 200 | HANDLE hThread = 0; |
| 201 | NTSTATUS ntStatus = 0; |
| 202 | |
| 203 | if (NativeWinApi::NtCreateThreadEx) |
| 204 | { |
| 205 | #define THREAD_ALL_ACCESS_VISTA_7 (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFFF) |
| 206 | |
| 207 | //for windows vista/7 |
| 208 | ntStatus = NativeWinApi::NtCreateThreadEx(&hThread, THREAD_ALL_ACCESS_VISTA_7, 0, hProcess, (LPTHREAD_START_ROUTINE)lpStartAddress, (LPVOID)lpParameter, NtCreateThreadExFlagCreateSuspended|NtCreateThreadExFlagHideFromDebugger, 0, 0, 0, 0); |
| 209 | if (NT_SUCCESS(ntStatus)) |
| 210 | { |
| 211 | return hThread; |
| 212 | } |
| 213 | else |
| 214 | { |
| 215 | #ifdef DEBUG_COMMENTS |
| 216 | Scylla::debugLog.log(L"customCreateRemoteThread :: NtCreateThreadEx failed 0x%X", NativeWinApi::RtlNtStatusToDosError(ntStatus)); |
| 217 | #endif |
| 218 | return 0; |
| 219 | } |
| 220 | } |
| 221 | else |
| 222 | { |
| 223 | return CreateRemoteThread(hProcess,NULL,NULL,(LPTHREAD_START_ROUTINE)lpStartAddress,lpParameter,CREATE_SUSPENDED,&lpThreadId); |
| 224 | } |
| 225 | } |