What's the difference GetProcAddress() and CreateRemoteThread()?

Now as I understand it, GetProcAddress links a DLL function into the current process memory, and then you can use it with a function pointer.

Why would you want to create a function that you've already linked to? By using CreateRemoteThread?

Why would one create a function that already exists?
'GetProcAddress()' simply tells you where a function can be found within a certain process's memory space. The reason that this is useful for thread injection is that 'kernel32.dll' always loads into a certain address space within a process. So the address for the function that you found from that module in your process will be the same valid address in the target process as well.

'CreateRemoteThread()' actually creates the thread that runs the function.
Topic archived. No new replies allowed.