CreateThread interception, to use CreateRemoteThread

sandbox/win/src/interceptors_64.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/interceptors_64.h"
 
 #include "sandbox/win/src/interceptors.h"
 #include "sandbox/win/src/filesystem_interception.h"
 #include "sandbox/win/src/named_pipe_interception.h"
 #include "sandbox/win/src/policy_target.h"
@@ skipping 183 matching lines @@
     LPPROCESS_INFORMATION process_information) {
   CreateProcessAFunction orig_fn = reinterpret_cast<
       CreateProcessAFunction>(g_originals[CREATE_PROCESSA_ID]);
   return TargetCreateProcessA(orig_fn, application_name, command_line,
                               process_attributes, thread_attributes,
                               inherit_handles, flags, environment,
                               current_directory, startup_info,
                               process_information);
 }
 
+SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateThread64(
+  LPSECURITY_ATTRIBUTES thread_attributes, SIZE_T stack_size,
+  LPTHREAD_START_ROUTINE start_address, PVOID parameter,
+  DWORD creation_flags, LPDWORD thread_id) {
+  CreateThreadFunction orig_fn = reinterpret_cast<
+    CreateThreadFunction>(g_originals[CREATE_THREAD_ID]);
+  return TargetCreateThread(orig_fn, thread_attributes, stack_size,
+    start_address, parameter, creation_flags, thread_id);
+}
+
+
 // -----------------------------------------------------------------------
 
 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtCreateKey64(
     PHANDLE key, ACCESS_MASK desired_access,
     POBJECT_ATTRIBUTES object_attributes, ULONG title_index,
     PUNICODE_STRING class_name, ULONG create_options, PULONG disposition) {
   NtCreateKeyFunction orig_fn = reinterpret_cast<
       NtCreateKeyFunction>(g_originals[CREATE_KEY_ID]);
   return TargetNtCreateKey(orig_fn, key, desired_access, object_attributes,
                            title_index, class_name, create_options,
@@ skipping 55 matching lines @@
 }
 
 SANDBOX_INTERCEPT ATOM WINAPI TargetRegisterClassW64(
     const WNDCLASS* wnd_class) {
   RegisterClassWFunction orig_fn = reinterpret_cast<
       RegisterClassWFunction>(g_originals[REGISTERCLASSW_ID]);
   return TargetRegisterClassW(orig_fn, wnd_class);
 }
 
 }  // namespace sandbox