I'm wondering about the LPVOID lpParameter
parameter of the CreateRemoteThread function. Because processes don't share memory, the remote thread can't access a struct in our process. So, does the function copy the parameter and manages it by it own or do we need to allocate memory with VirtualAllocEx and then call WriteProcessMemory to actually copy the struct into the remote process?
CreateRemoteThread
does not do any automatic management of lpParameter
. You are correct, it is up to the developer to ensure that lpParameter
is a valid pointer in the context of the target process. VirtualAllocEx
and WriteProcessMemory
are definitely options for doing so.