I'm wondering about the
LPVOID lpParameter parameter of the CreateRemoteThread function. Because processes don't share memory, the remote thread can't access a struct in our process. So, does the function copy the parameter and manages it by it own or do we need to allocate memory with VirtualAllocEx and then call WriteProcessMemory to actually copy the struct into the remote process?
CreateRemoteThread does not do any automatic management of
lpParameter. You are correct, it is up to the developer to ensure that
lpParameter is a valid pointer in the context of the target process.
WriteProcessMemory are definitely options for doing so.