挂起方式创建进程

创建进程除了用 CREATE_NEW_CONSOLE,还可以用挂起的方式创建，CREATE_SUSPENDED

// TestCreateSuspended.cpp : Defines the entry point for the console application.
// 挂起方式创建进程

#include "stdafx.h"
#include <WINDOWS.H>

int main(int argc, char* argv[])
{
	// 挂起方式创建进程
	STARTUPINFO si = {0};
	si.cb = sizeof(si);
	PROCESS_INFORMATION pi;
	char szPath[MAX_PATH] = "c:\\notepad.exe";
	CreateProcess(NULL, szPath, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
	// 获取线程上下文
	CONTEXT context;
	context.ContextFlags = CONTEXT_FULL;
	GetThreadContext(pi.hThread, &context);
	// 获取入口点
	DWORD dwEntryPoint = context.Eax;
	printf("入口点: %x\n", dwEntryPoint);
	// 获取ImageBase
	char *baseAddress = (char *)context.Ebx + 8;
	char szBuffer[256] = {0};
	ReadProcessMemory(pi.hProcess, baseAddress, szBuffer, 4, NULL);
	
	// 恢复线程
	ResumeThread(pi.hThread);
	getchar();
	return 0;
}

运行结果