- 公开视频 -> 链接点击跳转公开课程
- 博客首页 -> 链接点击跳转博客主页
目录
Thread
Thread Control
创建 - Create
执行 - Execute
挂起 - Suspend
恢复 - Resume
终止 - Terminate
远程 - Remote
Thread Info
GetCurrentThread/Id
GetThreadContext
CreateToolhelp32Snapshot
Thread
-
什么是线程？
-
线程是CPU进行调度的最小单位，它被包含在进程中。
-
一个进程可以并发多条线程，每条线程分别执行不同的任务。
-
每条线程都拥有自己的一套寄存器以及堆栈信息，并且线程可以同时共享同一进程中的数据以及代码资源。
-
-
线程与进程的关系？
-
进程
-
拥有独立的内存空间。
-
拥有独立的执行环境。
-
进程间通信需要特殊机制。
-
-
线程
-
线程是进程的一部分，共享相同的内存空间。
-
每条线程都有自己独立的执行环境。
-
线程间可以直接读写进程中的数据资源等。
-
-
关系
-
进程是操作系统进程资源分配以及调度的基本单位。
-
线程作为进程的一部分，是进程内部的执行单位，一个进程至少包含一个线程，即主线程。
-
-
Thread Control
创建 - Create
-
线程是通过CreateThread来创建的，该API会为线程分配必要的资源并返回一个内核对象句柄。
-
创建线程是可以通过参数指定线程的属性，线程运行状态(创建运行线程 、创建挂起线程)，以及堆栈大小。
-
CreateThread
-
WaitForSingleObject
#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{DWORD dwCount = 0;while (dwCount <= 10){std::cout << " WorkThread " << dwCount++ << std::endl;Sleep(1000);}std::cout << "WorkThread Exit" << std::endl;return 0;
}int main()
{DWORD dwTid = 0;HANDLE hThread = CreateThread(NULL,0,WorkThread,NULL,0,&dwTid);if (hThread == NULL) return 0;DWORD dwTime = WaitForSingleObject(hThread, INFINITE);std::cout << dwTime << std::endl;return 0;
}#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{DWORD dwCount = 0;while (dwCount <= 10){std::cout << " WorkThread " << (DWORD)lp << "\t" << dwCount++ << std::endl;Sleep(1000);}std::cout << "WorkThread " << (DWORD)lp << "\t" << " Exit " << std::endl;return 0;
}int main()
{HANDLE hThread[3] = { 0 };hThread[0] = CreateThread(NULL, 0, WorkThread, (LPVOID)1, 0, NULL);hThread[1] = CreateThread(NULL, 0, WorkThread, (LPVOID)2, 0, NULL);hThread[2] = CreateThread(NULL, 0, WorkThread, (LPVOID)3, 0, NULL);DWORD dwTime = WaitForMultipleObjects(3, hThread, TRUE, -1);return 0;
}执行 - Execute
-
使用CreateThread创建线程时，当参数不指定CREATE_SUSPENDED时，线程会进去就绪等待调度。
-
指定CREATE_SUSPENDED时，线程会进入挂起状态，需要使用ResumeThread恢复线程运行状态。
#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{while (1){std::cout << "WorkThread" << std::endl;Sleep(1000);}return 0;
}int main()
{HANDLE hThread = CreateThread(NULL, 0, WorkThread, NULL, CREATE_SUSPENDED, NULL);system("pause");ResumeThread(hThread);system("pause");return 0;
}
挂起 - Suspend
- SuspendThread
#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{DWORD dwCount = 0;while (1){std::cout << dwCount++ << std::endl;Sleep(500);}return 0;
}int main()
{HANDLE hThread = CreateThread(NULL, 0, WorkThread, NULL, 0, NULL);if (hThread == NULL) return 0;system("pause");SuspendThread(hThread);system("pause");ResumeThread(hThread);system("pause");return 0;
}
恢复 - Resume
- ResumeThread
#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{DWORD dwCount = 0;while (1){std::cout << dwCount++ << std::endl;Sleep(500);}return 0;
}int main()
{HANDLE hThread = CreateThread(NULL, 0, WorkThread, NULL, 0, NULL);if (hThread == NULL) return 0;system("pause");SuspendThread(hThread);system("pause");ResumeThread(hThread);system("pause");return 0;
}
终止 - Terminate
- TerminateThread
#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{while (1){std::cout << "WorkThread" << std::endl;Sleep(500);}return 0;
}int main()
{HANDLE hThread = CreateThread(NULL, 0, WorkThread, NULL, 0, NULL);if (hThread == NULL) return 0;system("pause");TerminateThread(hThread, 3);WaitForSingleObject(hThread, -1);//0x103 == ACTIVEDWORD dwCode = -1;GetExitCodeThread(hThread, &dwCode);system("pause");CloseHandle(hThread);return 0;
}
- ExitThread
#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{DWORD dwCount = 0;while (1){std::cout << "WorkThread" << std::endl;Sleep(500);if (dwCount++ >= 5){ExitThread(5);}}return 0;
}int main()
{HANDLE hThread = CreateThread(NULL, 0, WorkThread, NULL, 0, NULL);if (hThread == NULL) return 0;WaitForSingleObject(hThread, -1);DWORD dwCode = 0;GetExitCodeThread(hThread, &dwCode);CloseHandle(hThread);return 0;
}
远程 - Remote
#include <iostream>
#include <Windows.h>int main()
{HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 67780);if (hProcess == INVALID_HANDLE_VALUE) return 0;HANDLE hThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)0x487085,NULL,0,NULL);if (hThread == NULL) return 0;WaitForSingleObject(hThread, -1);CloseHandle(hProcess);CloseHandle(hThread);/*VirtualAllocEx Addr 68 C4 08 01 00 push 108C4h6A 00 push 068 FF FF 1F 00 push 1FFFFFhFF 15 0C A0 51 00 call dword ptr [__imp__OpenProcess@12 (051A00Ch)]C3 ret*/return 0;
}
Thread Info
GetCurrentThread/Id
#include <iostream>
#include <Windows.h>int main()
{printf("Process Handle -> 0x%08x \r\n", GetCurrentProcess());printf("Thread Handle -> 0x%08x \r\n", GetCurrentThread());printf("Process Id -> 0x%08x \r\n", GetCurrentProcessId());printf("Thread Id -> 0x%08x \r\n", GetCurrentThreadId());printf("Thread Id -> 0x%08x \r\n", GetProcessId(GetCurrentProcess()));printf("Thread Id -> 0x%08x \r\n", GetThreadId(GetCurrentThread()));return 0;
}GetThreadContext
#include <iostream>
#include <Windows.h>DWORD WINAPI WorkThread(LPVOID lp)
{std::cout << "WorkThread " << (DWORD)lp << std::endl;while (true){Sleep(1000);}return 0;
}int main()
{HANDLE hThread = CreateThread(NULL, 0, WorkThread, NULL, 0, NULL);if (hThread == NULL) return 0;Sleep(3000);SuspendThread(hThread);CONTEXT context = { 0 };context.ContextFlags = CONTEXT_ALL;GetThreadContext(hThread, &context);ResumeThread(hThread);return 0;
}CreateToolhelp32Snapshot
#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>int main()
{HANDLE hSnapProcess = NULL;HANDLE hSnapThread = NULL;PROCESSENTRY32 pe32 = { 0 };pe32.dwSize = sizeof(pe32);THREADENTRY32 te32 = { 0 };te32.dwSize = sizeof(te32);// 系统进程快照hSnapProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);if (hSnapProcess == INVALID_HANDLE_VALUE) return 0;// 遍历系统进程if (Process32First(hSnapProcess, &pe32)){do{// 获取进程标识std::cout << "Process Id -> " << pe32.th32ProcessID << std::endl;// 系统线程快照hSnapThread = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);if (hSnapThread == INVALID_HANDLE_VALUE) return 0;// 遍历系统线程if (Thread32First(hSnapThread, &te32)){do{// 比较线程进程if (te32.th32OwnerProcessID == pe32.th32ProcessID){std::cout << "\t" << "Thread Id -> " << te32.th32ThreadID << std::endl;}} while (Thread32Next(hSnapThread, &te32));}CloseHandle(hSnapThread);} while (Process32Next(hSnapProcess, &pe32));}CloseHandle(hSnapProcess);return 0;
}
