Sign in to follow this  
Followers 0
eracross

StartAddress Thread/ suspend

4 posts in this topic

Hi i jst want to ask if its possible to supend a thread by his StratAddress, Im not good at DllCall so i asked you :graduated:

Like this but not by TID.( MostafaGamal)

Func _ThreadSuspend($TID)
    $Handle = DllCall("kernel32.dll","ptr", "OpenThread","dword", "0x0002","int", "0","dword",$TID)
    $i_sucess = DllCall("kernel32.dll","dword","SuspendThread","ptr",$Handle[0])
    DllCall("kernel32.dll", "ptr", "CloseHandle", "ptr", $Handle)
EndFunc

Share this post


Link to post
Share on other sites



Suspending a thread 'parks' the thread inside the ntdll.dll module. You can't change that behavior. Redirecting code execution flow, on the other hand, is another story (and would be hacking).

Share this post


Link to post
Share on other sites

Suspending a thread 'parks' the thread inside the ntdll.dll module. You can't change that behavior. Redirecting code execution flow, on the other hand, is another story (and would be hacking).

Thanks but i didnt get it. :graduated:

if im wrong the Tid is always change thats why i want to know if its possible to suspend it by startaddress.

I think i need to know more about Dllcalls..

Share this post


Link to post
Share on other sites

Process ID #'s and Thread ID #'s don't change. They remain consistent until termination of the thread or process.

If you need to actually get Thread ID #'s for a process, then you'll need to use other API calls to achieve that.

My Processes, Threads & DLL's UDFs contain all kinds of API calls to get all the information you could possibly want from a process or thread.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0