CreateThread interception, to use CreateRemoteThread

sandbox/win/src/interceptors_64.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/nt_internals.h"
 #include "sandbox/win/src/sandbox_types.h"
 
 #ifndef SANDBOX_SRC_INTERCEPTORS_64_H_
 #define SANDBOX_SRC_INTERCEPTORS_64_H_
 
@@ skipping 104 matching lines @@
     LPPROCESS_INFORMATION process_information);
 
 // Interception of CreateProcessA in kernel32.dll.
 SANDBOX_INTERCEPT BOOL WINAPI TargetCreateProcessA64(
     LPCSTR application_name, LPSTR command_line,
     LPSECURITY_ATTRIBUTES process_attributes,
     LPSECURITY_ATTRIBUTES thread_attributes, BOOL inherit_handles, DWORD flags,
     LPVOID environment, LPCSTR current_directory, LPSTARTUPINFOA startup_info,
     LPPROCESS_INFORMATION process_information);
 
+// Interception of CreateThread in kernel32.dll.
+SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateThread64(
+  LPSECURITY_ATTRIBUTES thread_attributes, SIZE_T stack_size,
+  LPTHREAD_START_ROUTINE start_address, PVOID parameter,
+  DWORD creation_flags, LPDWORD thread_id);
+
+
 // -----------------------------------------------------------------------
 // Interceptors handled by the registry dispatcher.
 
 // Interception of NtCreateKey on the child process.
 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtCreateKey64(
     PHANDLE key, ACCESS_MASK desired_access,
     POBJECT_ATTRIBUTES object_attributes, ULONG title_index,
     PUNICODE_STRING class_name, ULONG create_options, PULONG disposition);
 
 // Interception of NtOpenKey on the child process.
@@ skipping 31 matching lines @@
 SANDBOX_INTERCEPT HGDIOBJ WINAPI TargetGetStockObject64(int object);
 
 // Interceptor for the RegisterClassW function.
 SANDBOX_INTERCEPT ATOM WINAPI TargetRegisterClassW64(const WNDCLASS* wnd_class);
 
 }  // extern "C"
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_SRC_INTERCEPTORS_64_H_