ring3不使用api枚举线程

上午有个同事问的一个问题,让俺翻出了一个N久前写的代码:

    ENUMTHREAD m_stThread;    ULONG ulPebAddr;    ULONG ulTemp;    __asm    {        pushad        mov eax,fs:[0x18];        mov eax,[eax+0x30]        mov ulPebAddr,eax        popad    }    ulTemp = 0x7fef0000;

    while(true)    {        ulTemp-=0x1000;        __try         {            if (*(ULONG*)(ulTemp+0x30) == ulPebAddr && *(ULONG*)(ulTemp+0x18) == ulTemp)            {                m_stThread.iThreadId = *(ULONG*)(ulTemp+0x24);                m_stThread.ulTebAddr = ulTemp;                m_stTreadList.push_back(m_stThread);            }        }__except(...)        {            if (ulTemp <= MIN_TEB_ADDR )            {                break;            }        }    }

虽然虽然虽然,但是还是有些情况下使用这种方式非常方便.