win32线程

HANDLE CreateThread(
  LPSECURITY_ATTRIBUTES   lpThreadAttributes,     SD安全属性
  SIZE_T                  dwStackSize,                          创建线程的堆栈大小.为0则默认
  LPTHREAD_START_ROUTINE  lpStartAddress,        创建线程执行代码的地址.
  __drv_aliasesMem LPVOID lpParameter,                创建线程需要的参数
  DWORD                   dwCreationFlags,                   创建标志.挂起创建还是普通创建
  LPDWORD                 lpThreadId                           返回创建的线程ID
); 
 返回值: 返回创建的线程句柄.

DWORD SuspendThread(
  HANDLE hThread              需要线程句柄
);

DWORD Wow64SuspendThread(    64位调用的API
  HANDLE hThread
);

DWORD ResumeThread(
  HANDLE hThread          传入要恢复线程执行的线程句柄
);

HANDLE OpenThread(
  DWORD dwDesiredAccess,       访问权限
  BOOL  bInheritHandle,        是否可以继承
  DWORD dwThreadId             线程ID
); 
返回线程句柄

DWORD WaitForSingleObject(
HANDLE hObject,         //指明一个内核对象的句柄 注意可以等待的是内核对象不一定是线程.
DWORD dwMilliseconds   //等待时间
);     

DWORD WaitForSingleObject(
DWORD count;            //指明的个数
HANDLE *hObject,         //指明一个内核对象的数组指针
DWORD  dwflages          //等待模式. 如果TURE则数组里面的句柄都等待.false相反.有一个返回就返回
DWORD dwMilliseconds   //等待时间
);    

typedef struct _CONTEXT {

    //
    // The flags values within this flag control the contents of
    // a CONTEXT record.
    //
    // If the context record is used as an input parameter, then
    // for each portion of the context record controlled by a flag
    // whose value is set, it is assumed that that portion of the
    // context record contains valid context. If the context record
    // is being used to modify a threads context, then only that
    // portion of the threads context will be modified.
    //
    // If the context record is used as an IN OUT parameter to capture
    // the context of a thread, then only those portions of the thread's
    // context corresponding to set flags will be returned.
    //
    // The context record is never used as an OUT only parameter.
    //

    DWORD ContextFlags;

    //
    // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is
    // set in ContextFlags.  Note that CONTEXT_DEBUG_REGISTERS is NOT
    // included in CONTEXT_FULL.
    //

    DWORD   Dr0;
    DWORD   Dr1;
    DWORD   Dr2;
    DWORD   Dr3;
    DWORD   Dr6;
    DWORD   Dr7;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_FLOATING_POINT.
    //

    FLOATING_SAVE_AREA FloatSave;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_SEGMENTS.
    //

    DWORD   SegGs;
    DWORD   SegFs;
    DWORD   SegEs;
    DWORD   SegDs;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_INTEGER.
    //

    DWORD   Edi;
    DWORD   Esi;
    DWORD   Ebx;
    DWORD   Edx;
    DWORD   Ecx;
    DWORD   Eax;

    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_CONTROL.
    //

    DWORD   Ebp;
    DWORD   Eip;
    DWORD   SegCs;              // MUST BE SANITIZED
    DWORD   EFlags;             // MUST BE SANITIZED
    DWORD   Esp;
    DWORD   SegSs;

    //
    // This section is specified/returned if the ContextFlags word
    // contains the flag CONTEXT_EXTENDED_REGISTERS.
    // The format and contexts are processor specific
    //

    BYTE    ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];

} CONTEXT;

而设置的值在这个结构中的注释也说了. CONTEXT_INTEGER 可以给定这个.也可以自己定义.具体查看注释说明.

BOOL GetThreadContext(
  HANDLE    hThread,           线程句柄
  LPCONTEXT lpContext          传入Context结构.操作系统写入.给我们传出
); 

BOOL Wow64GetThreadContext(
  HANDLE         hThread,
  PWOW64_CONTEXT lpContext
);

BOOL SetThreadContext(
  HANDLE        hThread,      线程句柄
  CONST CONTEXT *lpContext    CONTEXT结构
);

BOOL Wow64SetThreadContext(
  HANDLE              hThread,
  CONST WOW64_CONTEXT *lpContext
);