StartAddress Thread/ suspend

[eracross]

Hi i jst want to ask if its possible to supend a thread by his StratAddress, Im not good at DllCall so i asked you

Like this but not by TID.( MostafaGamal)

Func _ThreadSuspend($TID)
    $Handle = DllCall("kernel32.dll","ptr", "OpenThread","dword", "0x0002","int", "0","dword",$TID)
    $i_sucess = DllCall("kernel32.dll","dword","SuspendThread","ptr",$Handle[0])
    DllCall("kernel32.dll", "ptr", "CloseHandle", "ptr", $Handle)
EndFunc

[Ascend4nt]

Suspending a thread 'parks' the thread inside the ntdll.dll module. You can't change that behavior. Redirecting code execution flow, on the other hand, is another story (and would be hacking).

[eracross]

Suspending a thread 'parks' the thread inside the ntdll.dll module. You can't change that behavior. Redirecting code execution flow, on the other hand, is another story (and would be hacking).

Thanks but i didnt get it.

if im wrong the Tid is always change thats why i want to know if its possible to suspend it by startaddress.

I think i need to know more about Dllcalls..

[Ascend4nt]

Process ID #'s and Thread ID #'s don't change. They remain consistent until termination of the thread or process.

If you need to actually get Thread ID #'s for a process, then you'll need to use other API calls to achieve that.

My Processes, Threads & DLL's UDFs contain all kinds of API calls to get all the information you could possibly want from a process or thread.