-1

I have the following assembly code :

.....
lea eax, [ebp+ThreadID]
push eax              ; lpThreadID
push 0                ; dwCreationFlags
push 0                ; lpParameter
push offset StartAddress  ; lpStartAddress
push 0                ; dwStackSize
call CreateThread
....

So, I try to translate it in a C-like pseudocode:

DWORD* LPWORD eax_lpThreadID = NULL;
DWORD dwCreationFlags;
void *LPVOID lpParameter;
SIZE_T dwStackSize;
LPSECURITY ATTRIBUTES lpThreadAttributes;

HANDLE handle_to_new_Thread = CreateThread(lpThreadAttributes, dwStackSize, ..., lpParameter, dwCreationFlags, eax_lpThreadID );

As you can see, I do not include the 3rd parameter, namely the parameter LPTHREAD_START_ROUTINE lpStartAddress, because I have problems understanding it. In this SO thread i have read that a LPTHREAD_START_ROUTINE is a function pointer defined as:

typedef DWORD (__stdcall *LPTHREAD_START_ROUTINE) (
  [in] LPVOID lpThreadParameter
);

That would mean that the 4th parameter lpThreadParameter is a parameter of this. But how can I integrate that information into my pseudo C code program ? I am little bit confused about that. Can someone explain it to me? The other attributes/parameters are clear....

1

In C pseudocode let's say you have a function called doJob. You want to create a thread to executes it.

DWORD WINAPI doJob(LPVOID lpParameter){
    // Do some work. You can only pass one parameter.
    // If you need more parameters, define a structure
    // and send it though it's pointer.
    return statuscode;
}

Handle hThread = 
   CreateThread(&attributes,dwStackSize,&doJob,&paramstruct,flags,&newThreadIdBuffer);

Or in asm (nasm syntax, if I still remember it):

lea eax, newThreadIdBuffer
push eax
push 0 ; or 4 or 0x00010000 or 0x00010004
lea eax, paramstruct
push eax
lea eax, doJob
push eax
push dwStackSize ; 0 will use default
lea eax, attributes
push eax
call CreateThread

This can be done cleaner, but I believe it demonstrates the concept.

2

From MSDN

lpStartAddress is a pointer to the application-defined function to be executed by the thread. This pointer represents the starting address of the thread.

Basically lpStartAddress is the entry point of the thread. This is a callback function. It will be called when the thread is created and executed.

More on this,

The CreateThread function creates a new thread for a process. The creating thread must specify the starting address of the code that the new thread is to execute. Typically, the starting address is the name of a function defined in the program code (for more information, see ThreadProc). This function takes a single parameter and returns a DWORD value. A process can have multiple threads simultaneously executing the same function.

See this page, for an example on creating threads.

2
lea eax, [ebp+ThreadID]
push eax              ; lpThreadID
push 0                ; dwCreationFlags
push 0                ; lpParameter
push offset StartAddress  ; lpStartAddress
push 0                ; dwStackSize
call CreateThread

the first argument is pushed last so you have got it all reversed up also it seems during copy paste you missed one argument lpSecurtiyAttributes

cpp

Handle hThread = CreateThread(&lpThreadId,NULL,NULL,&lpStartAddress,NULL,NULL); 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.