ntdll: CreateRemoteThread and friends for remote processes, take 3, via APCs

[Thomas Kho]

On 8/3/06, Thomas Kho <tkho at ucla.edu> wrote:
> On 8/3/06, Mike Hearn <mike at plan99.net> wrote:
> > Just one thing - can you try
> > it with something copy protected? I think some programs rely on being able
> > to CreateRemoteThread into a program that runs all the time and never
> > sleeps (eg games that try and get the highest FPS possible).
>
> Do you know of a game that does this? I can't readily find one...

Unable to test a copy protected app, I was able to get the WinSpy app
at http://www.codeguru.com/cpp/w-p/system/processesmodules/article.php/c5767/
working with minor changes (there was a bug in WinSpy, see
http://silenceisdefeat.org/~tkho/patches/WinSpy-fix.patch). This
little app excercises a common pattern of
VirtualAllocEx/CreateRemoteThread/VirtualFreeEx.

Tommy