unsigned long GetTargetThreadIdFromProcname(char *procName) 
{ 
	PROCESSENTRY32 pe; //用来存放快照进程信息的一个结构体
	HANDLE thSnapshot, hProcess; 
	BOOL retval, ProcFound = false; 
	unsigned long pTID, threadID; 

	/************************************************************************/
	/* HANDLE WINAPI CreateToolhelp32Snapshot(
	DWORD dwFlags, //用来指定“快照”中需要返回的对象，可以是TH32CS_SNAPPROCESS等
	DWORD th32ProcessID //一个进程ID号，用来指定要获取哪一个进程的快照，当获取系统进程列表或获取 当前进程快照时可以设为0
	);                                                                     */
	/************************************************************************//

	thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 

	if(thSnapshot == INVALID_HANDLE_VALUE) 
	{ 
		MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL); 
		return false; 
	} 

	pe.dwSize = sizeof(PROCESSENTRY32); 

	retval = Process32First(thSnapshot, &pe); 

	while(retval) 
	{ 
		if(stricmp(pe.szExeFile, procName) == 0) 
		{ 
			ProcFound = true; 
			break; 
		} 

		retval = Process32Next(thSnapshot,&pe); 
		pe.dwSize = sizeof(PROCESSENTRY32); 
	} 

		CloseHandle(thSnapshot); 

	[COLOR="Red"]	_asm { 
		mov eax, fs:[0x18] 
		add eax, 36 
		mov [pTID], eax 
	} [/COLOR]

	hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID); 
	ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL); 
	CloseHandle(hProcess); 

	return threadID; 
}

[培训]科锐逆向工程师培训第53期2025年7月8日开班！