1

What does CreateRemoteThread do to actually create the remote thread?

user37875
  • 13,904
  • 9
  • 37
  • 43

2 Answers2

2

Inside the kernel, the lowest level thread creation function is really just creating a thread object, connecting it to a process and making it runnable. CreateThread and CreateRemoteThread are really the same API and work the same way, the only difference being that CreateThread only allows you to create a thread in the current process while CreateRemoteThread allows you to specify a process to create a thread in.

This means that CreateThread is pretty much the same as CreateRemoteThread(GetCurrentProcess(), ....)

Stewart
  • 3,978
  • 17
  • 20
1

It calls NtCreateThreadEx, which is a kernel call.

Vladimir Panteleev
  • 24,651
  • 6
  • 70
  • 114