We help IT Professionals succeed at work.

SetThreadContext does not change EIP imediatly, only after a msg is received. Why?

eebruno
eebruno used Ask the Experts™
on
Hello!

I'm using SetThreadContext to change the EIP of a thread of another process, then I use ResumeThread, But the thread only resumes after I do something for the thread (like... move the mouse around the window), this kind of things.

Why is this happening? How to imediatly resume the execution of the thread?

Thank you very mutch!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
Try to post WM_NULL message to destination process window.
Commented:
That thread is probably inside of a waiting function like WaitForSingleObject or WaitMessage. Changing the EIP does not change the wait state. You need to wake up the thread somehow. If it's waiting for a message, you need to post a message. If it's waiting for something else, you might have a problem. But since moving the mouse helps, it's probably waiting for a message. That should be doable. Maybe PostThreadMessage is good enough to wake the thread up.

Btw, why do you do that? Perhaps you should better use CreateRemoteThread? Hijacking threads of other processes by changing the EIP behind its back is known to have some stability problems at times.

Author

Commented:
Thank you for replying, but.. Madshi,

I've tryed to use

PostThreadMessage( ThreadID, WM_NCACTIVATE, Integer( TRUE ), 0);

that I got from ELiCZ, but its not working too...

I do not use CreateRemoteThread coz it does not work under win9x... I am aware of the stability problem.

AlexFM: I only have the thread handle, not the window handle.. :-(

Author

Commented:
I've splited because I've used the PostThreadMessage (like Mathias said) with WM_NULL as AlexFM said. Worked well, thank you