typedef DWORD (*LPTHREAD_START_ROUTINE) (LPVOID lpThreadParameter);

typedef NTSTATUS (*PFNTCREATETHREADEX)  
(   
 PHANDLE                 ThreadHandle,     
 ACCESS_MASK             DesiredAccess,    
 POBJECT_ATTRIBUTES       ObjectAttributes,     
 HANDLE                  ProcessHandle,    
 LPTHREAD_START_ROUTINE      lpStartAddress,   
 PVOID                  lpParameter,      
 BOOL                    CreateSuspended,          
 SIZE_T                  ZeroBits OPTIONAL,
 SIZE_T                  StackSize OPTIONAL,
 SIZE_T                   MaximumStackSize OPTIONAL,
 PVOID                    AttributeList 
 ); 

PFNTCREATETHREADEX MyNtCreateThreadEx =  NULL;
ULONG OldTpVal;

NTSTATUS  Fake_NtCreateThreadEx( PHANDLE                 ThreadHandle,     
									  ACCESS_MASK             DesiredAccess,    
									  POBJECT_ATTRIBUTES       ObjectAttributes,     
									  HANDLE                  ProcessHandle,    
									  LPTHREAD_START_ROUTINE     lpStartAddress,   
									  PVOID                  lpParameter,      
									  BOOL                    CreateSuspended,      
									  SIZE_T                   ZeroBits,
									  SIZE_T                   StackSize,
									  SIZE_T                   MaximumStackSize OPTIONAL,
									  PVOID                   AttributeList
									  )
{
	DbgPrint("11111\n");
 
	return MyNtCreateThreadEx(ThreadHandle,
		DesiredAccess,
		ObjectAttributes,
		ProcessHandle,
		lpStartAddress,
		lpParameter,
		CreateSuspended,
		ZeroBits,
		StackSize,
		MaximumStackSize,
		AttributeList);

}

[课程]Linux pwn 探索篇！