/*
=======================================
进程启停
=======================================
*/
CR_API BOOL WINAPI
ProcessCtrl (
__CR_IN__ DWORD prcss_id,
__CR_IN__ BOOL suspend
)
{
HANDLE snap;
THREADENTRY32 te32;
/* 取得指定进程的所有线程信息 */
snap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, prcss_id);
if (snap == INVALID_HANDLE_VALUE)
return (HLB_ERROR);
/* 枚举线程 */
te32.dwSize = sizeof(THREADENTRY32);
if(!Thread32First(snap, &te32)) {
CloseHandle(snap);
return (HLB_ERROR);
}
do {
if (te32.th32OwnerProcessID == prcss_id)
{
HANDLE handle;
handle = OpenThread(THREAD_SUSPEND_RESUME, FALSE,
te32.th32ThreadID);
if (suspend)
SuspendThread(handle);
else
ResumeThread(handle);
CloseHandle(handle);
}
} while (Thread32Next(snap, &te32));
CloseHandle(snap);
return (HLB_OKAY);
}
BOOL CDemo_ClipView_VCDlg::GetThreadIdList(CList<int>& tIdList) {
int pID = _getpid();
HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
THREADENTRY32 te32;
hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, pID);
if (hThreadSnap == INVALID_HANDLE_VALUE) {
return FALSE;
}
te32.dwSize = sizeof(THREADENTRY32);
BOOL bGetThread = Thread32First(hThreadSnap, &te32);
while (bGetThread) {
if (te32.th32OwnerProcessID == pID) {
tIdList.AddTail(te32.th32ThreadID);
}
bGetThread = Thread32Next(hThreadSnap, &te32);
}
CloseHandle(hThreadSnap);
return TRUE;
}
int Ten18::Util::EnumerateNativeThreads(bool traceFullInfo, const char* msg)
{
Ten18_UNUSED(traceFullInfo);
DebugOut(msg);
int numThreads = 0;
auto snapshot = MakeScoped(CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0), [] (HANDLE snapshot) { Ten18_HOPE_FOR.True = CloseHandle(snapshot); });
Ten18_EXPECT.Not(INVALID_HANDLE_VALUE) = static_cast<HANDLE>(snapshot);
THREADENTRY32 te = {};
te.dwSize = sizeof(te);
const auto minSizeOfInterest = (std::min)((FIELD_OFFSET(THREADENTRY32, th32OwnerProcessID) + sizeof(te.th32OwnerProcessID)),
(FIELD_OFFSET(THREADENTRY32, th32OwnerProcessID) + sizeof(te.th32ThreadID)));
if (Thread32First(snapshot, &te))
{
do
{
if (te.dwSize >= minSizeOfInterest)
if (te.th32OwnerProcessID == GetCurrentProcessId())
{
++numThreads;
auto thread = MakeScoped(OpenThread(THREAD_QUERY_INFORMATION, FALSE, te.th32ThreadID), [] (HANDLE t) { Ten18_HOPE_FOR.NotZero = CloseHandle(t); });
Ten18_EXPECT.NotNull = static_cast<HANDLE>(thread);
ULONG64 cycleTime = 0;
Ten18_EXPECT.True = QueryThreadCycleTime(thread, &cycleTime);
FILETIME create, exit, kernel, user;
Ten18_EXPECT.True = GetThreadTimes(thread, &create, &exit, &kernel, &user);
Format("\tNative Thread %0 - Create: %1, Exit: %2, Kernel: %3, User: %4, Cycles: %5",
te.th32ThreadID, create.dwLowDateTime, exit.dwLowDateTime, kernel.dwLowDateTime, user.dwLowDateTime, static_cast<int>(cycleTime)).DebugOut();
}
te.dwSize = sizeof(te);
}
while (Thread32Next(snapshot, &te));
}
Format("Number of Native Threads: %0", numThreads).DebugOut();
return numThreads;
}
void GetAllThreadsCallstacks(str::Str<char>& s)
{
HANDLE threadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (threadSnap == INVALID_HANDLE_VALUE)
return;
THREADENTRY32 te32;
te32.dwSize = sizeof(THREADENTRY32);
DWORD pid = GetCurrentProcessId();
BOOL ok = Thread32First(threadSnap, &te32);
while (ok) {
if (te32.th32OwnerProcessID == pid)
GetThreadCallstack(s, te32.th32ThreadID);
ok = Thread32Next(threadSnap, &te32);
}
CloseHandle(threadSnap);
}
BOOL process_suspendOrResumeAllThreads(DWORD dwPID, BOOL bSuspend) {
HANDLE hSnapT;
HANDLE hT;
THREADENTRY32 te32;
if (INVALID_HANDLE_VALUE == (hSnapT = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)))
return FALSE;
te32.dwSize = sizeof(THREADENTRY32);
if (FALSE == Thread32First(hSnapT, &te32)) {
return TRUE;
}
while (TRUE) {
if (dwPID == te32.th32OwnerProcessID) {
if (NULL == (hT = OpenThread(THREAD_SUSPEND_RESUME, FALSE, te32.th32ThreadID))) {
utils_debugOutputErrCode(GetLastError());
return FALSE;
}
if (bSuspend) {
if (-1 == SuspendThread(hT)) {
utils_debugOutputErrCode(GetLastError());
CloseHandle(hT);
return FALSE;
}
}
else {
if (-1 == ResumeThread(hT)) {
utils_debugOutputErrCode(GetLastError());
CloseHandle(hT);
return FALSE;
}
}
CloseHandle(hT);
}
if (FALSE == (Thread32Next(hSnapT, &te32)))
break;
}
return TRUE;
}
void injecta_apc(DWORD pid,char *dllname,opt *options) {
//MessageBox(0,"injecta_apc","",MB_OK);
HANDLE hProcess = OpenProcess (MAXIMUM_ALLOWED,0,pid);
//WaitForInputIdle(hProcess,2000);//fix some bugs on REINJECT
HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
BOOL threadFound=FALSE;
if (hThreadSnap != INVALID_HANDLE_VALUE) {
THREADENTRY32 th32;
th32.dwSize = sizeof(THREADENTRY32);
BOOL bOK = TRUE;
for (bOK = Thread32First(hThreadSnap, &th32); bOK; bOK = Thread32Next(hThreadSnap, &th32)) {
if (th32.th32OwnerProcessID == pid) {
//printf("[info] DLL Injected into thread ID %d\n",th32.th32ThreadID);
HANDLE h = OpenThread (THREAD_ALL_ACCESS , 0, th32.th32ThreadID);
if(h){
threadFound=TRUE;
HANDLE addr = (HANDLE)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
//Allocate new memory region inside the process's address space.
LPVOID arg = (LPVOID)VirtualAllocEx(hProcess, NULL, strlen(dllname), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if(arg == NULL) {
printf("Error: the memory could not be allocated inside the chosen process\n");
}
//Write the argument to LoadLibraryA to the process's newly allocated memory region.
int n = WriteProcessMemory(hProcess, arg, dllname, strlen(dllname), NULL);
if(n == 0) {
printf("Error: there was no bytes written to the process's address space\n");
}
QueueUserAPC((HANDLE)addr, h, (DWORD)arg);
//MessageBox(0,dllname,"APC Injection done",MB_OK);
//printf("[error] QueueUserAPC. Code: %d\n",GetLastError());
}else{
printf("[error] OpenThread. Code: %d\n",GetLastError());
}
CloseHandle(h);
//break;
}
}
CloseHandle(hThreadSnap);
}
CloseHandle(hProcess);
if(!threadFound) printf("[ERROR] THREAD NOT FOUND!\n");
}
//-------------------------------------------------------------------------
static void EnumerateThreads(void)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (hSnapshot != INVALID_HANDLE_VALUE)
{
THREADENTRY32 te;
__stosb((PBYTE)&te, 0, sizeof(THREADENTRY32));
te.dwSize = sizeof(THREADENTRY32);
if (Thread32First(hSnapshot, &te))
{
do
{
if (te.th32OwnerProcessID == GetCurrentProcessId()
&& te.th32ThreadID != GetCurrentThreadId())
{
if (g_threads.items == NULL)
{
g_threads.capacity = MH_INITIAL_THREAD_CAPACITY;
g_threads.items
= (LPDWORD)HeapAlloc(g_hHeap, 0, g_threads.capacity * sizeof(DWORD));
if (g_threads.items == NULL)
break;
}
else if (g_threads.size >= g_threads.capacity)
{
LPDWORD p;
g_threads.capacity *= 2;
p = (LPDWORD)HeapReAlloc(
g_hHeap, 0, g_threads.items, g_threads.capacity * sizeof(DWORD));
if (p != NULL)
g_threads.items = p;
else
break;
}
g_threads.items[g_threads.size++] = te.th32ThreadID;
}
} while (Thread32Next(hSnapshot, &te));
}
}
CloseHandle(hSnapshot);
}
//-------------------------------------------------------------------------
static VOID EnumerateThreads(PFROZEN_THREADS pThreads)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (hSnapshot != INVALID_HANDLE_VALUE)
{
THREADENTRY32 te;
te.dwSize = sizeof(THREADENTRY32);
if (Thread32First(hSnapshot, &te))
{
do
{
if (te.dwSize >= (FIELD_OFFSET(THREADENTRY32, th32OwnerProcessID) + sizeof(DWORD))
&& te.th32OwnerProcessID == GetCurrentProcessId()
&& te.th32ThreadID != GetCurrentThreadId())
{
if (pThreads->pItems == NULL)
{
pThreads->capacity = MH_INITIAL_THREAD_CAPACITY;
pThreads->pItems
= (LPDWORD)HeapAlloc(g_hHeap, 0, pThreads->capacity * sizeof(DWORD));
if (pThreads->pItems == NULL)
break;
}
else if (pThreads->size >= pThreads->capacity)
{
LPDWORD p = (LPDWORD)HeapReAlloc(
g_hHeap, 0, pThreads->pItems, (pThreads->capacity * 2) * sizeof(DWORD));
if (p == NULL)
break;
pThreads->capacity *= 2;
pThreads->pItems = p;
}
pThreads->pItems[pThreads->size++] = te.th32ThreadID;
}
te.dwSize = sizeof(THREADENTRY32);
} while (Thread32Next(hSnapshot, &te));
}
CloseHandle(hSnapshot);
}
}
BOOL ListProcessThreads( DWORD dwOwnerPID )
{
HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
THREADENTRY32 te32;
// Take a snapshot of all running threads
hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
if( hThreadSnap == INVALID_HANDLE_VALUE )
return( FALSE );
// Fill in the size of the structure before using it.
te32.dwSize = sizeof(THREADENTRY32);
// Retrieve information about the first thread,
// and exit if unsuccessful
if( !Thread32First( hThreadSnap, &te32 ) )
{
//printError( TEXT("Thread32First") ); // show cause of failure
printf( "Thread32First" );
CloseHandle( hThreadSnap ); // clean the snapshot object
return( FALSE );
}
// Now walk the thread list of the system,
// and display information about each thread
// associated with the specified process
do
{
if( te32.th32OwnerProcessID == dwOwnerPID )
{
/*
_tprintf( TEXT("\n\n THREAD ID = 0x%08X"), te32.th32ThreadID );
_tprintf( TEXT("\n Base priority = %d"), te32.tpBasePri );
_tprintf( TEXT("\n Delta priority = %d"), te32.tpDeltaPri );
_tprintf( TEXT("\n"));
*/
}
} while( Thread32Next(hThreadSnap, &te32 ) );
CloseHandle( hThreadSnap );
return( TRUE );
}
DWORD GetMainThreadId() {
const std::shared_ptr<void> hThreadSnapshot(
CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0), CloseHandle);
if (hThreadSnapshot.get() == INVALID_HANDLE_VALUE) {
throw std::runtime_error("GetMainThreadId failed");
}
THREADENTRY32 tEntry;
tEntry.dwSize = sizeof(THREADENTRY32);
DWORD result = 0;
DWORD currentPID = GetCurrentProcessId();
for (BOOL success = Thread32First(hThreadSnapshot.get(), &tEntry);
!result && success && GetLastError() != ERROR_NO_MORE_FILES;
success = Thread32Next(hThreadSnapshot.get(), &tEntry))
{
if (tEntry.th32OwnerProcessID == currentPID) {
result = tEntry.th32ThreadID;
}
}
return result;
}
static inline void write_thread_traces(struct exception_handler_data *data)
{
THREADENTRY32 entry = {0};
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,
GetCurrentProcessId());
bool success;
if (snapshot == INVALID_HANDLE_VALUE)
return;
entry.dwSize = sizeof(entry);
success = !!Thread32First(snapshot, &entry);
while (success) {
write_thread_trace(data, &entry);
success = !!Thread32Next(snapshot, &entry);
}
CloseHandle(snapshot);
}
/*
This method is used to get a thread id for a process.
It loops through all of the threads and compares their pid with the desired pid
*/
DWORD getThreadID(DWORD pid)
{
puts("Getting Thread ID");
HANDLE h = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if(h != INVALID_HANDLE_VALUE)
{
THREADENTRY32 te;
te.dwSize = sizeof(te);
if( Thread32First(h, &te))
{
do
{
if (te.dwSize >= FIELD_OFFSET(THREADENTRY32, th32OwnerProcessID) + sizeof(te.th32OwnerProcessID))
{
if(te.th32OwnerProcessID == pid)
{
HANDLE hThread = OpenThread(READ_CONTROL, FALSE, te.th32ThreadID);
if(!hThread)
{
puts("Couldn't get thread handle");
}
else
{
//DWORD tpid = GetProcessIdOfThread(hThread);
//printf("Got one: %u\n", tpid);
return te.th32ThreadID;
}
}
//printf("hello");
}
}
while( Thread32Next(h, &te));
}
}
CloseHandle(h);
return (DWORD)0;
}
BOOL SuspendAllThreads(BOOL stop)
{
HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
THREADENTRY32 te32;
DWORD dwOwnerPID = GetCurrentProcessId();
DWORD dwOwnerTID = GetCurrentThreadId();
HANDLE hThread;
hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (hThreadSnap == INVALID_HANDLE_VALUE)
{
dbg_msg("[-] SuspendAllThreads - CreateToolhelp32Snapshot() failed\n");
return FALSE;
}
te32.dwSize = sizeof(THREADENTRY32);
if (!Thread32First(hThreadSnap, &te32))
{
dbg_msg("[-] SuspendAllThreads - Thread32First() failed\n");
CloseHandle(hThreadSnap);
return FALSE;
}
do
{
if (te32.th32OwnerProcessID == dwOwnerPID && te32.th32ThreadID != dwOwnerTID)
{
hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
if (stop == TRUE)
{
SuspendThread(hThread);
}
else
{
ResumeThread(hThread);
}
CloseHandle(hThread);
}
} while (Thread32Next(hThreadSnap, &te32));
CloseHandle(hThreadSnap);
return TRUE;
}
static DWORD GetMainThreadId() {
std::vector<ThreadInfo> threads;
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (snapshot != INVALID_HANDLE_VALUE) {
THREADENTRY32 thread_entry;
thread_entry.dwSize = sizeof(thread_entry);
if (Thread32First(snapshot, &thread_entry)) {
DWORD process_id = GetProcessId(GetCurrentProcess());
do {
if (thread_entry.dwSize >=
FIELD_OFFSET(THREADENTRY32, th32OwnerProcessID) +
sizeof(thread_entry.th32OwnerProcessID)) {
if (thread_entry.th32OwnerProcessID == process_id) {
ThreadInfo thread = {0};
thread.id = thread_entry.th32ThreadID;
threads.push_back(thread);
}
}
thread_entry.dwSize = sizeof(thread_entry);
} while (Thread32Next(snapshot, &thread_entry));
}
CloseHandle(snapshot);
}
for (std::vector<ThreadInfo>::iterator it = threads.begin();
it != threads.end(); it++) {
ThreadInfo &info = *it;
HANDLE handle = GetThreadHandle(info.id, THREAD_QUERY_INFORMATION);
GetThreadTimes(handle, &info.creation_time, &info.exit_time,
&info.kernel_time, &info.user_time);
}
threads.erase(std::remove_if(threads.begin(), threads.end(),
InvalidThread()), threads.end());
if (!threads.empty()) {
return std::min_element(threads.begin(), threads.end(),
CompareThreads())->id;
}
return 0;
}
//-------------------------------------------------------------
LONG WINAPI ExceptionFilter(EXCEPTION_POINTERS* pExceptionInfo)
{
if (IsDebuggerPresent())
return EXCEPTION_CONTINUE_SEARCH;
THREADENTRY32 te32;
DWORD myThreadId = GetCurrentThreadId();
DWORD myProcessId = GetCurrentProcessId();
HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (hThreadSnap != INVALID_HANDLE_VALUE)
{
te32.dwSize = sizeof(THREADENTRY32);
if (Thread32First(hThreadSnap, &te32))
{
do
{
if (te32.th32OwnerProcessID == myProcessId && te32.th32ThreadID != myThreadId)
{
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
if (hThread)
{
SuspendThread(hThread);
}
}
} while (Thread32Next(hThreadSnap, &te32));
}
CloseHandle(hThreadSnap);
}
// dump文件
MakeDump(pExceptionInfo);
// 强制进程退出
ExitProcess(1);
return EXCEPTION_EXECUTE_HANDLER;
}
DWORD ListThreadProcess(DWORD PID)
{
HANDLE hThreadSnap;
THREADENTRY32 t;
hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
t.dwSize = sizeof(THREADENTRY32);
if (!Thread32First(hThreadSnap, &t))
return (-1);
do
{
if (t.th32OwnerProcessID == PID)
{
printf("#### THREAD %d ####\n",t.th32ThreadID);
printf("\tThread FLAG : %d\n", t.dwFlags);
printf("\tThread USAGE : %d\n", t.cntUsage);
printf("\tThread BASE PRIORITY : %d\n", t.tpBasePri);
printf("\tThread DELTA PRIORITY : %d\n\n", t.tpDeltaPri);
}
} while (Thread32Next(hThreadSnap, &t));
return(1);
}
static void get_main_thread_id(void)
{
HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
THREADENTRY32 th32;
DWORD currentPID;
BOOL bOk;
if (hThreadSnap == INVALID_HANDLE_VALUE)
return;
currentPID = GetCurrentProcessId();
th32.dwSize = sizeof(THREADENTRY32);
for (bOk = Thread32First(hThreadSnap, &th32); bOk;
bOk = Thread32Next(hThreadSnap, &th32))
{
if (th32.th32OwnerProcessID == currentPID) {
acl_var_main_tid = th32.th32ThreadID;
break;
}
}
}
DWORD RMS_Socket::GetMainThreadId(DWORD processId)
{
if (processId == 0)
processId = GetCurrentProcessId();
DWORD threadId = 0;
THREADENTRY32 te32 = { sizeof(te32) };
HANDLE threadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (Thread32First(threadSnap, &te32))
{
do
{
if (processId == te32.th32OwnerProcessID)
{
threadId = te32.th32ThreadID;
break;
}
} while (Thread32Next(threadSnap, &te32));
}
return threadId;
}
std::vector<CONTEXT> get_threads(DWORD dwPid)
{
HANDLE h = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
std::vector<CONTEXT> threads;
if (h != INVALID_HANDLE_VALUE)
{
THREADENTRY32 te;
te.dwSize = sizeof(te);
if (Thread32First(h, &te))
{
do
{
if (te.th32OwnerProcessID == dwPid)
{
CONTEXT context = { 0 };
context.ContextFlags = CONTEXT_FULL;
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
SuspendThread(hThread);
if (GetThreadContext(hThread, &context))
threads.push_back(context);
DWORD dwError = GetLastError();
ResumeThread(hThread);
}
te.dwSize = sizeof(te); /* see: http://blogs.msdn.com/b/oldnewthing/archive/2006/02/23/537856.aspx */
} while (Thread32Next(h, &te));
}
CloseHandle(h);
}
return threads;
}
BOOL HwDetourDetach( DWORD dwLineAddress, DWORD dwType )
{
HANDLE hThreadSnap;
THREADENTRY32 te32;
static BOOL bExceptionHandlerUnSet = FALSE;
if (bExceptionHandlerUnSet == FALSE)
{
RemoveVectoredExceptionHandler(g_hVectorHandle);
bExceptionHandlerUnSet = !bExceptionHandlerUnSet;
}
hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, NULL );
if( hThreadSnap == INVALID_HANDLE_VALUE ) return FALSE;
te32.dwSize = sizeof( THREADENTRY32 );
if( Thread32First( hThreadSnap, &te32 ) )
{
do
{
if( te32.th32OwnerProcessID != GetCurrentProcessId() ||
te32.th32ThreadID == GetCurrentThreadId() )
continue;
UninstDbgBreakfromThrd( te32.th32ThreadID,dwLineAddress, dwType);
} while( Thread32Next( hThreadSnap, &te32 ) );
}
for(int i = 0; i < 4; i++)
{
if( dwLineAddress == g_ExceptionInfo[i].dwLineAddr)
{
g_ExceptionInfo[i].bIsFree = TRUE;
break;
}
}
return TRUE;
}
/* Lists threads of the running process plus
* Some information about them. */
BOOL GetThreadsList(INT NumberOfProcess,DWORD dwTID){
// Initializing Number of threads.
INT NumberOfThreads=0;
THREADENTRY32 th32;
HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
HANDLE hThread=INVALID_HANDLE_VALUE;
// Taking a sanpshot from threads of the process.
hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,0);
// Setting size of the structure before using it.
th32.dwSize=sizeof(THREADENTRY32);
// obtaining the first process and checking for error.
if(!Thread32First(hThreadSnap,&th32)){
// If there was an error ( because each process has at least one thread ).
PeInfo[NumberOfProcess].ThreadCount = NumberOfThreads;
// Clean the snapshot object.
CloseHandle(hThreadSnap);
return FALSE;
}
do{
if(th32.th32OwnerProcessID == dwTID){
// Opens an existing thread object.
hThread = OpenThread(THREAD_QUERY_INFORMATION ,FALSE,th32.th32ThreadID);
// Obtaining thread PIDs.
PeInfo[NumberOfProcess].Threads[NumberOfThreads].dwTID = th32.th32ThreadID;
// Obtaining Thread Priority.
PeInfo[NumberOfProcess].Threads[NumberOfThreads].ThreadPriority = GetThreadPriority(hThread);
// The number of CPU clock cycles used by the thread. This value includes cycles spent in both user mode and kernel mode.
QueryThreadCycleTime(hThread,&PeInfo[NumberOfProcess].Threads[NumberOfThreads].CycleTime);
// Closes the handle.
CloseHandle(hThread);
// Adding NumberOfThreads.
++NumberOfThreads;
}
}while(Thread32Next(hThreadSnap,&th32));
// Closing the handle object.
CloseHandle(hThreadSnap);
// assigning number of threads to the variable of that process.
PeInfo[NumberOfProcess].ThreadCount = NumberOfThreads;
return TRUE;
}
/*
=======================================
线程枚举
=======================================
*/
CR_API UINT WINAPI
ThreadList (
__CR_IN__ DWORD prcss_id,
__CR_OT__ THREADENTRY32** list
)
{
BOOL goon;
HANDLE snap;
THREADENTRY32 temp;
/* 取得指定进程的所有线程信息 */
snap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, prcss_id);
if (snap == INVALID_HANDLE_VALUE)
return (0);
std::vector<THREADENTRY32> vlist;
/* 枚举线程 */
temp.dwSize = sizeof(THREADENTRY32);
goon = Thread32First(snap, &temp);
while (goon) {
if (temp.th32OwnerProcessID == prcss_id)
vlist.push_back(temp);
temp.dwSize = sizeof(THREADENTRY32);
goon = Thread32Next(snap, &temp);
}
CloseHandle(snap);
size_t size = vlist.size();
/* 返回线程列表 */
if (size == 0)
return (0);
size *= sizeof(THREADENTRY32);
*list = (THREADENTRY32*)mem_malloc(size);
if (*list == NULL)
return (0);
memcpy(*list, &vlist[0], size);
return (vlist.size());
}
void set_breakpoints(void) {
HANDLE hTool32 = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if(hTool32 != INVALID_HANDLE_VALUE) {
THREADENTRY32 thread_entry32;
thread_entry32.dwSize = sizeof(THREADENTRY32);
FILETIME exit_time, kernel_time, user_time;
FILETIME creation_time;
FILETIME prev_creation_time;
prev_creation_time.dwLowDateTime = 0xFFFFFFFF;
prev_creation_time.dwHighDateTime = INT_MAX;
HANDLE hMainThread = NULL;
if(Thread32First(hTool32, &thread_entry32)) {
do {
if(thread_entry32.dwSize >= FIELD_OFFSET(THREADENTRY32, th32OwnerProcessID) + sizeof(thread_entry32.th32OwnerProcessID)
&& thread_entry32.th32OwnerProcessID == GetCurrentProcessId()
&& thread_entry32.th32ThreadID != GetCurrentThreadId()) {
HANDLE hThread = OpenThread(THREAD_SET_CONTEXT | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION,
FALSE, thread_entry32.th32ThreadID);
GetThreadTimes(hThread, &creation_time, &exit_time, &kernel_time, &user_time);
if(CompareFileTime(&creation_time, &prev_creation_time) == -1) {
memcpy(&prev_creation_time, &creation_time, sizeof(FILETIME));
if(hMainThread != NULL)
CloseHandle(hMainThread);
hMainThread = hThread;
}
else
CloseHandle(hThread);
}
thread_entry32.dwSize = sizeof(THREADENTRY32);
} while(Thread32Next(hTool32, &thread_entry32));
AddVectoredExceptionHandler(1, ExceptionFilter);
CONTEXT thread_context = {CONTEXT_DEBUG_REGISTERS};
thread_context.Dr0 = func_addr;
thread_context.Dr7 = (1 << 0);
SetThreadContext(hMainThread, &thread_context);
CloseHandle(hMainThread);
}
CloseHandle(hTool32);
}
}
HWND GetMainWindow( DWORD dwOwnerPID )
{
HWND hWnd = 0;
HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
THREADENTRY32 te32;
// Take a snapshot of all running threads
hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
if( hThreadSnap == INVALID_HANDLE_VALUE )
return( 0 );
// Fill in the size of the structure before using it.
te32.dwSize = sizeof(THREADENTRY32 );
// Retrieve information about the first thread,
// and exit if unsuccessful
if( !Thread32First( hThreadSnap, &te32 ) )
{
CloseHandle( hThreadSnap ); // Must clean up the snapshot object!
return( 0 );
}
// Now walk the thread list of the system,
// and display information about each thread
// associated with the specified process
do
{
if( te32.th32OwnerProcessID == dwOwnerPID )
{
EnumThreadWindows(te32.th32ThreadID, EnumProc, (LPARAM)&hWnd);
if(hWnd) break;
}
} while( Thread32Next(hThreadSnap, &te32 ) );
// Don't forget to clean up the snapshot object.
CloseHandle( hThreadSnap );
return( hWnd );
}
void
gum_process_enumerate_threads (GumFoundThreadFunc func,
gpointer user_data)
{
DWORD this_process_id;
HANDLE snapshot;
THREADENTRY32 entry;
this_process_id = GetCurrentProcessId ();
snapshot = CreateToolhelp32Snapshot (TH32CS_SNAPTHREAD, 0);
if (snapshot == INVALID_HANDLE_VALUE)
goto beach;
entry.dwSize = sizeof (entry);
if (!Thread32First (snapshot, &entry))
goto beach;
do
{
if (RTL_CONTAINS_FIELD (&entry, entry.dwSize, th32OwnerProcessID) &&
entry.th32OwnerProcessID == this_process_id)
{
GumThreadDetails details;
if (gum_windows_get_thread_details (entry.th32ThreadID, &details))
{
if (!func (&details, user_data))
break;
}
}
entry.dwSize = sizeof (entry);
}
while (Thread32Next (snapshot, &entry));
beach:
if (snapshot != INVALID_HANDLE_VALUE)
CloseHandle (snapshot);
}
List<THREADENTRY32> GetThreads(DWORD dwOwnerPID)
{
List<THREADENTRY32> ret;
HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
THREADENTRY32 te32;
// Take a snapshot of all running threads
hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (hThreadSnap == INVALID_HANDLE_VALUE)
return ret;
// Fill in the size of the structure before using it.
te32.dwSize = sizeof(THREADENTRY32);
// Retrieve information about the first thread,
// and exit if unsuccessful
if (!Thread32First(hThreadSnap, &te32))
{
printError("Thread32First"); // Show cause of failure
CloseHandle(hThreadSnap); // Must clean up the snapshot object!
return ret;
}
// Now walk the thread list of the system,
// and display information about each thread
// associated with the specified process
do
{
if (te32.th32OwnerProcessID == dwOwnerPID)
{
ret.push_back(te32);
}
} while (Thread32Next(hThreadSnap, &te32));
// Don't forget to clean up the snapshot object.
CloseHandle(hThreadSnap);
return ret;
}
void ScopedThreadExclusive::GetThreads(std::vector<DWORD>& threads)
{
ScopedHandle hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (hSnapshot == INVALID_HANDLE_VALUE)
{
return;
}
THREADENTRY32 te = { sizeof(te) };
if (Thread32First(hSnapshot, &te))
{
do
{
if (te.th32OwnerProcessID == GetCurrentProcessId()
&& te.th32ThreadID != GetCurrentThreadId())
{
threads.push_back(te.th32ThreadID);
}
}
while (Thread32Next(hSnapshot, &te));
}
}
//////////////////////////////////////////////////////////////////////////
//
// ¸ðµç ¾²·¹µå¸¦ °¡µ¿½ÃŲ´Ù
//
//////////////////////////////////////////////////////////////////////////
void CRawHookMgr::ResumeAllThread()
{
// ¸ðµç ¾²·¹µåµéÀÇ ½º³À¼¦À» ¸¸µì´Ï´Ù.
HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, GetCurrentProcessId());
if(hThreadSnap == INVALID_HANDLE_VALUE) return;
THREADENTRY32 te32;
memset(&te32, 0,sizeof(THREADENTRY32));
te32.dwSize = sizeof(THREADENTRY32);
// ÇöÀç ÇÁ·Î¼¼½ºID¿Í ¾²·¹µåID
DWORD dwCurPID = GetCurrentProcessId();
DWORD dwCurTID = GetCurrentThreadId();
// ¾²·¹µå ¼øȸ
BOOL bNext = Thread32First(hThreadSnap, &te32);
while(bNext)
{
if( te32.th32OwnerProcessID == dwCurPID && te32.th32ThreadID != dwCurTID )
{
// ¾²·¹µå Á¤Áö
HANDLE hThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, te32.th32ThreadID);
if(hThread)
{
ResumeThread(hThread);
//CloseHandle(hThread);
}
}
bNext = Thread32Next(hThreadSnap, &te32);
}
CloseHandle (hThreadSnap);
m_bIsAllThreadSuspended = FALSE;
}
void thresume(DWORD processId)
{
HANDLE hThreadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
THREADENTRY32 threadEntry;
threadEntry.dwSize = sizeof(THREADENTRY32);
Thread32First(hThreadSnapshot, &threadEntry);
do
{
if (threadEntry.th32OwnerProcessID == processId)
{
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE,
threadEntry.th32ThreadID);
ResumeThread(hThread);
//SuspendThread(hThread);
CloseHandle(hThread);
}
} while (Thread32Next(hThreadSnapshot, &threadEntry));
CloseHandle(hThreadSnapshot);
}
int TraceAllThreadByPid(const DWORD Pid,DWORD *Tid)
{
int count=0;
THREADENTRY32 th32;
th32.dwSize=sizeof(th32);//指定结构的长度，以字节为单位。在调用Thread32First时，设置这个成员为SIZEOF（THREADENTRY32）。如果你不初始化的dwSize，Thread32First将调用失败。
HANDLE hThreadSnap=::CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,0);
//CreateToolhelp32Snapshot可以通过获取进程信息为指定的进程、进程使用的堆[HEAP]、模块[MODULE]、线程建立一个快照。
if(hThreadSnap==INVALID_HANDLE_VALUE)
{
return -1;
}
bool more=Thread32First(hThreadSnap,&th32);
while(more)
{
if(th32.th32OwnerProcessID==Pid)
{
Tid[count++]=th32.th32ThreadID;
}
more=Thread32Next(hThreadSnap,&th32);//hTreadSnap快照句柄
}
CloseHandle(hThreadSnap);
return count;
}
