THREADENTRY32 structure contains a member called
th32OwnerProcessID, which is described as:
The identifier of the process that created the thread.
I'm not sure if I understand how the
CreateRemoteThread function works. However, I would expect that the thread created by Process A via
CreateRemoteThread, in the address space of Process B, would have the
th32OwnerProcessID equal to the ID of Process A (if we were to take the description of the
th32OwnerProcessID as quoted above). I was a bit surprised to see that it is actually equal to the ID of Process B.
Could someone please explain why this is so? And how to get the ID of the actual creator of the thread, i.e. Process A in my example?