HANDLE CreateRemoteThread(
  HANDLE hProcess,
  LPSECURITY_ATTRIBUTES lpThreadAttributes,
  SIZE_T dwStackSize,
  LPTHREAD_START_ROUTINE lpStartAddress,
  LPVOID lpParameter,
  DWORD dwCreationFlags,
  LPDWORD lpThreadId
);

lpStartAddress
[in] Pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process.

我在进程A中调用CreateRemoteThread在进程B中创建个线程。lpStartAddress必需是进程B中函数的地址。那么我在进程A中如何能知道进程B中函数的地址呢？请大家指点一下:)

[培训]科锐逆向工程师培训第53期2025年7月8日开班！