I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow?

To what i'm going it's C++ on DLL injection...

I thought it was possible using CreateRemoteThread, but i don't know if it is necessary to pass the id of the thread.

  • You can use CreateRemoteThread but you'd need to make sure the function is a THREAD_START_ROUTINE. If not, make a stub for it. As for the thread: no, you don't (shouldn't) need anything like that.
    – Martin
    Dec 30, 2016 at 13:05
  • This question is not really clear. Why do you no longer think using CreateRemoteThread is possible?
    – NirIzr
    Dec 31, 2016 at 19:19

1 Answer 1


CreateRemoteThread() is used to create a new thread inside the remote process. The function will return the ID of the newly created thread. This can be used to load your DLL into the remote process, by passing the address of LoadLibrary() as the thread start address (note that you would need to VirtualAllocEx() and WriteProcessMemory() to place the filename in the remote process first).

Once your DLL is loaded, you would need to hook the function of interest (via VirtualProtect(MEM_WRITABLE)/memcpy()/VirtualProtect(original protection)), since you can't inject directly into a thread. You can only modify the code that the thread is running, and then receive control indirectly.

Note that for safety, you would need to SuspendThread() the thread of interest before you make changes to its code, unless the function that you wish to alter is hot-patchable. In the case of a hot-patchable function, you would write the long jump at address function-5, and then write the short jump at the function start. The write of the short jump is an atomic operation so there is no risk of misaligned execution.

  • this pass the thread local storage without problems? thanks.
    – MindLerp
    Jan 14, 2017 at 19:31
  • yes, Thread Local Storage will still behave correctly. Jan 20, 2017 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.