kernel32

Documentation

Index

• func CreateRemoteThreadEx(hProcess uintptr, lpThreadAttributes uintptr, dwStackSize uintptr, ...) (addr uintptr, err error)
• func QueueUserAPC(pfnAPC uintptr, hThread uintptr, dwData uintptr) (err error)
• func VirtualAllocEx(hProcess uintptr, lpAddress uintptr, dwSize int, flAllocationType int, ...) (addr uintptr, err error)

Functions

func CreateRemoteThreadEx

func CreateRemoteThreadEx(hProcess uintptr, lpThreadAttributes uintptr, dwStackSize uintptr, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags int, lpAttributeList uintptr, lpThreadId uintptr) (addr uintptr, err error)

CreateRemoteThreadEx Creates a thread that runs in the virtual address space of another process and optionally specifies extended attributes such as processor group affinity. HANDLE CreateRemoteThreadEx(

[in]            HANDLE                       hProcess,
[in, optional]  LPSECURITY_ATTRIBUTES        lpThreadAttributes,
[in]            SIZE_T                       dwStackSize,
[in]            LPTHREAD_START_ROUTINE       lpStartAddress,
[in, optional]  LPVOID                       lpParameter,
[in]            DWORD                        dwCreationFlags,
[in, optional]  LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
[out, optional] LPDWORD                      lpThreadId

); https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethreadex

func QueueUserAPC

func QueueUserAPC(pfnAPC uintptr, hThread uintptr, dwData uintptr) (err error)

QueueUserAPC Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread. DWORD QueueUserAPC(

[in] PAPCFUNC  pfnAPC,
[in] HANDLE    hThread,
[in] ULONG_PTR dwData

); https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-queueuserapc

func VirtualAllocEx

func VirtualAllocEx(hProcess uintptr, lpAddress uintptr, dwSize int, flAllocationType int, flProtect int) (addr uintptr, err error)

VirtualAllocEx Reserves, commits, or changes the state of a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero.

LPVOID VirtualAllocEx(
  [in]           HANDLE hProcess,
  [in, optional] LPVOID lpAddress,
  [in]           SIZE_T dwSize,
  [in]           DWORD  flAllocationType,
  [in]           DWORD  flProtect
);

https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualallocex