DLL_Main实现对线程启动监控

废话不多直接上代码，懂得自然懂

typedef struct _THREAD_BASIC_INFORMATION {
    NTSTATUS                ExitStatus;
    PVOID                   TebBaseAddress;
    DWORD                   ClientId;
    KAFFINITY               AffinityMask;
    DWORD                   Priority;
    DWORD                   BasePriority;

} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

typedef DWORD (CALLBACK* NTQUERYINFORMATIONTHREAD)(HANDLE,DWORD,PVOID,DWORD,PDWORD);
NTQUERYINFORMATIONTHREAD NtQueryInformationThread=(NTQUERYINFORMATIONTHREAD)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtQueryInformationThread");
PVOID g_ploadlibrary = GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryW");

BOOL WINAPI DllMain(HMODULE hInstance,DWORD fdwReason,PVOID pvReserved)
{

   if (fdwReason==DLL_THREAD_ATTACH)
   {
	DWORD tid = GetCurrentThreadId();
	HANDLE hThread = OpenThread(THREAD_ALL_ACCESS,FALSE, tid);
	DWORD enter = 0 ;
	PVOID startaddr; 
	if (hThread)
	{		
		THREAD_BASIC_INFORMATION threadBasicInfo;
		NtQueryInformationThread(hThread,9,&startaddr,sizeof(startaddr),NULL);  
		CloseHandle ( hThread ) ;
		/*找到线程 入口 后回溯查询 参数 */
		DWORD _ebp = 0;
		__asm
		{
			mov _ebp,ebp
		}
		while (*(DWORD*)(_ebp) != (DWORD)startaddr)
		{
			_ebp = _ebp + 4; 
		}

		if (startaddr == g_ploadlibrary)
		{
			int nLen  = WideCharToMultiByte( CP_ACP, 0, *(LPCWCHAR*)(_ebp - 12), -1, NULL, 0, NULL, NULL );
			char* pResult = new char[nLen];
			WideCharToMultiByte( CP_ACP, 0, *(LPCWCHAR*)(_ebp - 12), -1, pResult, nLen, NULL, NULL );
			char s[255]={0};
			sprintf_s(s,"入口::%x 模块:%s",(DWORD)startaddr,pResult);
			OutputDebugString(s);
		}
	}	
   }
}