I am used to NtCreateThreadEx in window 7 x32 and it work done.
But in in window 7 x64 i couldn't. It failed with error: 0xC0000005 Access Violation.
It may be fail at struct NtCreateTheadExBuffer, but i can't got it.
Please, help me.
My source bellow:
typedef struct
{
ULONG Size;
ULONG Unknown1;
ULONG Unknown2;
PULONG Unknown3;
ULONG Unknown4;
ULONG Unknown5;
ULONG Unknown6;
PULONG Unknown7;
ULONG Unknown8;
} NtCreateTheadExBuffer;
typedef DWORD WINAPI NtCreateThreadExProc(PHANDLE, ACCESS_MASK, LPVOID, HANDLE, LPTHREAD_START_ROUTINE, LPVOID, BOOL, DWORD, DWORD, DWORD, LPVOID);
HANDLE NtCreateThreadEx(HANDLE hProcess, LPVOID lpRemoteThreadStart, LPVOID lpRemoteCallback)
{
HANDLE hRemoteThread = NULL;
ULONG dw0 = 0, dw1 = 0;
NtCreateTheadExBuffer Buffer;
memset(&Buffer, 0, sizeof(NtCreateTheadExBuffer));
Buffer.Size = sizeof(NtCreateTheadExBuffer);
Buffer.Unknown1 = 0x10006;
Buffer.Unknown2 = 0x16;
Buffer.Unknown3 = &dw1;
Buffer.Unknown4 = 0;
Buffer.Unknown5 = 0x10008;
Buffer.Unknown6 = 8;
Buffer.Unknown7 = &dw0;
Buffer.Unknown8 = 0;
NtCreateThreadExProc *NtCreateThreadX =
(NtCreateThreadExProc*)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCreateThreadEx");
if(NtCreateThreadX == NULL)
return NULL;
DWORD dw = 0;
if(!SUCCEEDED(dw = NtCreateThreadX(
&hRemoteThread, 0x1FFFFF, NULL,
hProcess,
(LPTHREAD_START_ROUTINE)lpRemoteThreadStart,
lpRemoteCallback,
FALSE,
NULL,
NULL,
NULL, &Buffer
)))
{
return NULL;
}
return hRemoteThread;
}