7,540
社区成员
发帖
与我相关
我的任务
分享
// CONTEXT.cpp : 定义控制台应用程序的入口点。
//
#include "stdafx.h"
#include <Windows.h>
#include <iostream>
#include <process.h>
#include <Winbase.h>
#include <strsafe.h>
using namespace std;
HANDLE * HChildHandle = new HANDLE; //子线程句柄
unsigned WINAPI newthread(void * lpParameter); //声明子线程函数
int _tmain(int argc, _TCHAR* argv[])
{
std::wcout.imbue(std::locale("chs"));
HANDLE H = (HANDLE)_beginthreadex(NULL,0,newthread,(void *)HChildHandle,0,NULL);
Sleep(1000);
CONTEXT context;
context.ContextFlags = CONTEXT_CONTROL;
if(*HChildHandle)
{
wcout<<HChildHandle<<'\t'<<*HChildHandle<<'\t'<<H<<endl;
SuspendThread(*HChildHandle); //线程挂起
if(GetThreadContext(*HChildHandle,&context))
{
wcout<<_T("获得线程上下文成功!")<<endl;
wcout<<_T("指令指针为:")<<context.Eip<<endl;
}
else
wcout<<_T("获得线程上下文失败!");
ResumeThread(*HChildHandle);
}
CloseHandle(*HChildHandle);
return 0;
}
unsigned WINAPI newthread(void * lpParameter)
{
HANDLE * hnewhandle = new HANDLE;
DuplicateHandle(GetCurrentProcess(),GetCurrentThread(),GetCurrentProcess(),hnewhandle,0,FALSE,DUPLICATE_SAME_ACCESS);
lpParameter = hnewhandle;
CloseHandle(*hnewhandle);
while (1)
{
//wcout<<_T("新进程在运行")<<endl;
}
return 0;
}