ThreadWow64Context

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//Link against call64.lib. In the link below you can find call64.lib, call64.dll, and
//call64.h
//https://code.google.com/p/ollytlscatch/downloads/detail?name=Call64.zip

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"
#include "Call64.h"


#define ThreadWow64Context           0x1D
#define CONTEXT_ALL 0x1003F


int __stdcall ZwSetInformationThread64(HANDLE hThread,unsigned long ThreadInformationClass,
                                        unsigned long* ThreadInformation,unsigned long ThreadInformationLength)
{
    LARGE_INTEGER_ loc_hThread={0};
        loc_hThread.Low=(unsigned long)hThread;
        if(hThread==(HANDLE)0xFFFFFFFE) loc_hThread.High=0xFFFFFFFF;
    LARGE_INTEGER_ loc_ThreadInformationClass={(unsigned long)ThreadInformationClass,0};
    LARGE_INTEGER_ loc_ThreadInformation={(unsigned long)ThreadInformation,0};
    LARGE_INTEGER_ loc_ThreadInformationLength={(unsigned long)ThreadInformationLength,0};

    LARGE_INTEGER_ ret;
    bool B=Call64(&ret,0x0A,0x4,&loc_hThread,&loc_ThreadInformationClass,&loc_ThreadInformation,&loc_ThreadInformationLength);
    if(B) return ret.Low;
}

void ThreadProc2()
{
    printf("Thread Procedure 2 called - Execution redirected\r\n");
    ExitThread(0);
    return;
}

void ThreadProc()
{
    printf("Thread Procedure 1 called \r\n");
    Sleep(INFINITE);
    return;
}

void main()
{
    unsigned long tid=0;
    HANDLE hThread=CreateThread(0,0x1000,(LPTHREAD_START_ROUTINE)&ThreadProc,0,CREATE_SUSPENDED,&tid);
    if(!hThread) return;
    CONTEXT* pCTX=(CONTEXT*)VirtualAlloc(0,0x1000,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);
    pCTX->ContextFlags=CONTEXT_ALL;
    GetThreadContext(hThread,pCTX);

    *(unsigned long*)(((unsigned char*)(pCTX))+0xB8)=(unsigned long)(&ThreadProc2);
    int ret=ZwSetInformationThread64(hThread,ThreadWow64Context,(unsigned long*)pCTX,sizeof(CONTEXT));
    if(ret<0)   printf("Error: %x\r\n",ret);
    else
    {
        printf("Okay\r\n");
        ResumeThread(hThread);
    }
    Sleep(INFINITE);
    return;
}