views:

28

answers:

2

What does CreateRemoteThread do to actually create the remote thread?

A: 

It calls NtCreateThreadEx, which is a kernel call.

CyberShadow
+2  A: 

Inside the kernel, the lowest level thread creation function is really just creating a thread object, connecting it to a process and making it runnable. CreateThread and CreateRemoteThread are really the same API and work the same way, the only difference being that CreateThread only allows you to create a thread in the current process while CreateRemoteThread allows you to specify a process to create a thread in.

This means that CreateThread is pretty much the same as CreateRemoteThread(GetCurrentProcess(), ....)

Stewart