I want to use the GetThreadContext function which requires a threadHandle as first parameter. I searched for hours, iterated over all threads in the program to find the main thread but it seems like nothing really works. So I don't need an answer on how to use GetThreadContext but on how to get the right thread handle to call the function correctly. Btw. I want to read and set the EIP to debug on of my programs. And please don't start recommending x64dbg or ida...
1 Answers
If the program has a window you can most likely treat that as the "main" thread even though Windows processes don't really have a main thread.
Call FindWindow+GetWindowThreadProcessId+OpenThread+GetThreadContext.
If the process does not have a window, you can enumerate the threads with the ToolHelp API and call GetThreadTimes to find the oldest thread and treat that as the "main" thread.
Related