Strange question about CreateRemoteThread

[DavidXanatos]

this LoaderThreads stuff sounds like its the cause of my issues: https://stackoverflow.com/questions/42789199/why-there-are-three-unexpected-worker-threads-when-a-win32-console-application-s/42789684

lets see if I can do something against it without modifying the registry.

[nulli]

Originally Posted by DavidXanatos

this LoaderThreads stuff sounds like its the cause of my issues: https://stackoverflow.com/questions/42789199/why-there-are-three-unexpected-worker-threads-when-a-win32-console-application-s/42789684

lets see if I can do something against it without modifying the registry.

I already mentioned another option that doesnt involves the registry in my post:
"You could also set the value in the targets PEB (untested):
PEB.ProcessParameters.LoaderThreads = 1"

[DavidXanatos]

Yes I saw that, and it seams to work

	PROCESS_BASIC_INFORMATION basicInfo;
	if (NT_SUCCESS(NtQueryInformationProcess(pi.hProcess, ProcessBasicInformation, &basicInfo, sizeof(PROCESS_BASIC_INFORMATION), NULL)) && basicInfo.PebBaseAddress != 0)
	{
		PEB peb;
		NTSTATUS status = ReadProcessMemory(pi.hProcess, basicInfo.PebBaseAddress, &peb, sizeof(PEB), NULL);

		BYTE ProcessParameters[1040];
		status = ReadProcessMemory(pi.hProcess, peb.ProcessParameters, &ProcessParameters, sizeof(ProcessParameters), NULL);

		const int LoaderThreads = 1036; // FIELD_OFFSET(RTL_USER_PROCESS_PARAMETERS, LoaderThreads);
		*((ULONG*)(ProcessParameters + LoaderThreads)) = 1; // disable parallel loading

		status = WriteProcessMemory(pi.hProcess, peb.ProcessParameters, &ProcessParameters, sizeof(ProcessParameters), NULL);
	}