HANDLE CreateRemoteThread( HANDLE hProcess , // OpenProcess LPSECURITY_ATTRIBUTES lpThreadAttributes , // 安全结构指针 NULL SIZE_T dwStackSize , // initial stack size 0 LPTHREAD_START_ROUTINE lpStartAddress , // thread function 指向我们的CALL地址 LPVOID lpParameter , // thread argument 传递的参数指针 NULL DWORD dwCreationFlags , // creation option 0 LPDWORD lpThreadId // thread identifier 返回一个线程ID标识 );
DWORD GetWindowThreadProcessId( HWND hWnd , // handle to window LPDWORD lpdwProcessId // process identifier );
HANDLE OpenProcess( DWORD dwDesiredAccess , // access flag BOOL bInheritHandle , // handle inheritance option DWORD dwProcessId // process identifier );
HWND hwnd;
hwnd=::FindWindow(NULL,windowcaption);
DWORD id;
LPDWORD pid=&id;
::GetWindowThreadProcessId(hwnd,pid);
HANDLE hp=OpenProcess(PROCESS_ALL_ACCESS,false,id);
DWORD tid;
CreateRemoteThread(hp,NULL,0,LPTHREAD_START_ROUTINE(calladr),NULL,0,&tid);