ring3不使用api枚举线程

上午有个同事问的一个问题,让俺翻出了一个N久前写的代码:

    ENUMTHREAD m_stThread;
    ULONG ulPebAddr;
    ULONG ulTemp;
    __asm
    {
        pushad
        mov eax,fs:[0x18];
        mov eax,[eax+0x30]
        mov ulPebAddr,eax
        popad
    }
    ulTemp = 0x7fef0000;

    while(true)
    {
        ulTemp-=0x1000;
        __try 

        {
            if (*(ULONG*)(ulTemp+0x30) == ulPebAddr && *(ULONG*)(ulTemp+0x18) == ulTemp)
            {
                m_stThread.iThreadId = *(ULONG*)(ulTemp+0x24);
                m_stThread.ulTebAddr = ulTemp;
                m_stTreadList.push_back(m_stThread);
            }

        }__except(...)
        {
            if (ulTemp <= MIN_TEB_ADDR )
            {
                break;
            }
        }

    }

虽然虽然虽然,但是还是有些情况下使用这种方式非常方便.