The THREADENTRY32
structure contains a member called th32OwnerProcessID
, which is described as:
The identifier of the process that created the thread.
I'm not sure if I understand how the CreateRemoteThread
function works. However, I would expect that the thread created by Process A via CreateRemoteThread
, in the address space of Process B, would have the th32OwnerProcessID
equal to the ID of Process A (if we were to take the description of the th32OwnerProcessID
as quoted above). I was a bit surprised to see that it is actually equal to the ID of Process B.
Could someone please explain why this is so? And how to get the ID of the actual creator of the thread, i.e. Process A in my example?