CreateThread interception, to use CreateRemoteThread

sandbox/win/src/process_thread_interception.h

Index: sandbox/win/src/process_thread_interception.h
diff --git a/sandbox/win/src/process_thread_interception.h b/sandbox/win/src/process_thread_interception.h
index 31dc231543db5709c9832f795244b720bda1e270..aff1f6d046f39291dfb7adce38a4f124e29d05ea 100644
--- a/sandbox/win/src/process_thread_interception.h
+++ b/sandbox/win/src/process_thread_interception.h
@@ -36,11 +36,11 @@ typedef BOOL (WINAPI *CreateProcessAFunction)(
     LPSTARTUPINFOA lpStartupInfo,
     LPPROCESS_INFORMATION lpProcessInformation);
 
-typedef HANDLE (WINAPI *CreateThreadFunction)(
+typedef HANDLE(WINAPI* CreateThreadFunction)(
     LPSECURITY_ATTRIBUTES lpThreadAttributes,
     SIZE_T dwStackSize,
     LPTHREAD_START_ROUTINE lpStartAddress,
-    PVOID lpParameter,
+    LPVOID lpParameter,
     DWORD dwCreationFlags,
     LPDWORD lpThreadId);
 
@@ -83,6 +83,16 @@ SANDBOX_INTERCEPT BOOL WINAPI TargetCreateProcessA(
     LPVOID environment, LPCSTR current_directory, LPSTARTUPINFOA startup_info,
     LPPROCESS_INFORMATION process_information);
 
+// Interception of CreateThread in kernel32.dll.
+SANDBOX_INTERCEPT HANDLE WINAPI
+TargetCreateThread(CreateThreadFunction orig_CreateThread,
+                   LPSECURITY_ATTRIBUTES thread_attributes,
+                   SIZE_T stack_size,
+                   LPTHREAD_START_ROUTINE start_address,
+                   LPVOID parameter,
+                   DWORD creation_flags,
+                   LPDWORD thread_id);
+
 }  // extern "C"
 
 }  // namespace sandbox