I have the following assembly lines:
PUSH 0 PUSH 4 ; CreationFlags = CREATE_SUSPENDED PUSH 0 PUSH program.0040163B ; start address of thread PUSH 0 PUSH 0 CALL DWORD PTR DS: ; kernel32.CreateThread MOV DWORD PTR DS:[4023F8], EAX ; store handle to created thread to [4023F8] .... .... LEA ESI, DWORD PTR DS: PUSH ESI ;  will be the location where we store the context of the thread PUSH DWORD PTR DS:[4023F8] ; handle to created thread CALL DWORD PTR DS: ; kernel32.GetThreadContext MOV [ESI+B0], program.004010E9 ; [ESI+B0] = [4020B0] = 0040163B (starting address of the created thread will be replaced by 004010E9, I guess) PUSH ESI ; ESI points to 402000 where the thread context is stored, but now with a modified starting address of the thread PUSH DWORD PTR DS:[4023F8] ; handle to thread CALL DWORD PTR DS: ; kernel32.SetThreadContext PUSH DWORD PTR DS:[4023F8] CALL DWORD PTR DS: ; kernel32.ResumeThread .... .... RETN
So, to sum up: We create a thread in suspended state. Its starting address is 0040163B. Then we get the thread context and store it into 402000. By adding the offset of B0 to 402000, we reach the place where the starting address of the thread is stored in the context structure. We change it to 004010E9 and set the modified context using SetThreadContext.
So, my question would be: When I reach/call ResumeThread(), then will be 0040163B the starting address of the the thread, or 004010E9 ? Because of the combination of Get-and SetThreadContext, it would make sense that the starting address of my thread must be 004010E9, but I wanted to be sure.
In short my question is (1) if I create a suspended thread (2) Change its entry-point via SetThreadContext (3) Resume the suspended thread
will the thread begin execution at the original entry-point as specified by
CreateThread or at the newly modified one ?