远程线程

CreateRemoteThread()

HANDLE CreateRemoteThread(
  	HANDLE hProcess,                       	   // 进程句柄
  	LPSECURITY_ATTRIBUTES lpThreadAttributes,  // SD
  	SIZE_T dwStackSize,                        // initial stack size
  	LPTHREAD_START_ROUTINE lpStartAddress,     // thread function
  	LPVOID lpParameter,                        // thread argument
  	DWORD dwCreationFlags,                     // creation option
  	LPDWORD lpThreadId                        // thread identifier
);

程序A:

#include "stdafx.h"
#include <windows.h>

void Test()
{
	for(int i=0;i<10;i++)
	{
		Sleep(500);
		printf("Test()++++\n");
	}
}

DWORD WINAPI ThreadProc(LPVOID lpParameter)
{
	Test();
	return 0;

}



int main(int argc, char* argv[])
{
	HANDLE hThread;
	hThread = CreateThread(NULL,0,ThreadProc,NULL,0,NULL);
	CloseHandle(hThread);
	getchar();
	return 0;
}

函数地址为：0x0040BF10 &