Thread Kill Example

[doqukanlas]

Hey! I'm new about these hacks and bypass, can anybody give me a example for thread killing?

[harris1g]

process hacker a7a

[RingleRangleRob]

Originally Posted by doqukanlas

Hey! I'm new about these hacks and bypass, can anybody give me a example for thread killing?

i wrote it 2017.. maybe it will help you

ThreadMng.h

#pragma once
#include <windows.h>
#include <tlhelp32.h>
#include <tchar.h>
#include <string>

enum THREADINFOCLASS
{
	ThreadQuerySetWin32StartAddress = 9,
};

typedef NTSTATUS(__stdcall * f_NtQueryInformationThread)(HANDLE, THREADINFOCLASS, void*, ULONG_PTR, ULONG_PTR*);

class ThreadMng
{
public:
	ThreadMng();
	~ThreadMng();

	void Suspend();
	void Resume();

	HANDLE mHandle;
	bool SearchForThreadByStartAddress(DWORD dwStartAddress, DWORD ModuleBaseOffset, DWORD dwOwnerPID = 0);

	ULONG_PTR GetThreadStartAddress(HANDLE hThread);
private:

};

ThreadMng.cpp

#include "ThreadMng.h"



ThreadMng::ThreadMng()
{
}

void ThreadMng::Suspend()
{
	SuspendThread(mHandle);
}

void ThreadMng::Resume()
{
	ResumeThread(mHandle);
}

bool ThreadMng::SearchForThreadByStartAddress(DWORD dwStartAddress, DWORD ModuleBaseOffset, DWORD dwOwnerPID)
{
	HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
	THREADENTRY32 te32;
	HANDLE hTempThread;

	hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	if (hThreadSnap == INVALID_HANDLE_VALUE)
		return false;

	te32.dwSize = sizeof(THREADENTRY32);

	if (!Thread32First(hThreadSnap, &te32))
	{
		CloseHandle(hThreadSnap);          // clean the snapshot object
		return false;
	}

	do
	{
		if (te32.th32OwnerProcessID == dwOwnerPID)
		{
			HANDLE tHandle = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
			if ((GetThreadStartAddress(tHandle) - ModuleBaseOffset) == dwStartAddress)
			{
				mHandle = tHandle;
				break;
			}
			CloseHandle(tHandle);
		}
	} while (Thread32Next(hThreadSnap, &te32));

	CloseHandle(hThreadSnap);
	return true;
}

ULONG_PTR ThreadMng::GetThreadStartAddress(HANDLE hThread)
{
	auto NtQueryInformationThread = reinterpret_cast<f_NtQueryInformationThread>(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationThread"));
	if (!NtQueryInformationThread)
		return 0;

	ULONG_PTR ulStartAddress = 0;
	NTSTATUS Ret = NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &ulStartAddress, sizeof(ULONG_PTR), nullptr);

	if (Ret)
		return 0;

	return ulStartAddress;
}

ThreadMng::~ThreadMng()
{
}

[doqukanlas]

Originally Posted by harris1g

process hacker a7a

i know that ^^ but i need to automate that

Originally Posted by RingleRangleRob

i wrote it 2017.. maybe it will help you

ThreadMng.h

#pragma once
#include <windows.h>
#include <tlhelp32.h>
#include <tchar.h>
#include <string>

enum THREADINFOCLASS
{
	ThreadQuerySetWin32StartAddress = 9,
};

typedef NTSTATUS(__stdcall * f_NtQueryInformationThread)(HANDLE, THREADINFOCLASS, void*, ULONG_PTR, ULONG_PTR*);

class ThreadMng
{
public:
	ThreadMng();
	~ThreadMng();

	void Suspend();
	void Resume();

	HANDLE mHandle;
	bool SearchForThreadByStartAddress(DWORD dwStartAddress, DWORD ModuleBaseOffset, DWORD dwOwnerPID = 0);

	ULONG_PTR GetThreadStartAddress(HANDLE hThread);
private:

};

ThreadMng.cpp

#include "ThreadMng.h"



ThreadMng::ThreadMng()
{
}

void ThreadMng::Suspend()
{
	SuspendThread(mHandle);
}

void ThreadMng::Resume()
{
	ResumeThread(mHandle);
}

bool ThreadMng::SearchForThreadByStartAddress(DWORD dwStartAddress, DWORD ModuleBaseOffset, DWORD dwOwnerPID)
{
	HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
	THREADENTRY32 te32;
	HANDLE hTempThread;

	hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	if (hThreadSnap == INVALID_HANDLE_VALUE)
		return false;

	te32.dwSize = sizeof(THREADENTRY32);

	if (!Thread32First(hThreadSnap, &te32))
	{
		CloseHandle(hThreadSnap);          // clean the snapshot object
		return false;
	}

	do
	{
		if (te32.th32OwnerProcessID == dwOwnerPID)
		{
			HANDLE tHandle = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
			if ((GetThreadStartAddress(tHandle) - ModuleBaseOffset) == dwStartAddress)
			{
				mHandle = tHandle;
				break;
			}
			CloseHandle(tHandle);
		}
	} while (Thread32Next(hThreadSnap, &te32));

	CloseHandle(hThreadSnap);
	return true;
}

ULONG_PTR ThreadMng::GetThreadStartAddress(HANDLE hThread)
{
	auto NtQueryInformationThread = reinterpret_cast<f_NtQueryInformationThread>(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationThread"));
	if (!NtQueryInformationThread)
		return 0;

	ULONG_PTR ulStartAddress = 0;
	NTSTATUS Ret = NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &ulStartAddress, sizeof(ULONG_PTR), nullptr);

	if (Ret)
		return 0;

	return ulStartAddress;
}

ThreadMng::~ThreadMng()
{
}

thank you! it's absolutely will help

[bmeale9]

Wrong section btw ^^

[K1ramoX]

closed, wrong section