type
  TInjectCode = packed record
    instr_call_getpid   : WORD;   // call []
    adr_from_call_getpid: DWORD;  // @GetCurrentProcessID

    instr_mov_ax: BYTE;           // mov,
    instr_mov_opcode: BYTE;       //  ax,
    adr_to_move : DWORD;          //   [target]

    instr_push_exitthread_arg: BYTE;  // push
    exitthread_arg           : DWORD; // 0

    instr_call_exitthread   : WORD;   // call
    adr_from_call_exitthread: DWORD;  // @ExitThread

    addr_getpid    : DWORD;           // Address of GetCurrentProcessID
    addr_exitthread: DWORD;           // Address of ExitThread

    addr_ret_val: DWORD; // Here the pid will be written
  end;

function GetPIDByHandle(AProcessHandle: THandle): DWORD;
var
  LInjectCode: TInjectCode;
  LThread: THandle;
  LThreadID: Cardinal;
  P: Pointer;
  N: Cardinal;
begin
  // Allocate memory for further writing and execution of machine instructions
  P := VirtualAllocEx(AProcessHandle, nil, SizeOf(LInjectCode),
    MEM_COMMIT, PAGE_EXECUTE_READWRITE);

  // Fill the region with machine instructions
  //   call GetCurrentProcessID
  //   mov [adr_to_move], eax
  //   push 0
  //   call ExitThread
  with LInjectCode do
  begin
    // Call GetCurrentProcessID in the context of target process
    instr_call_getpid    := $15ff; // call
    adr_from_call_getpid := DWORD(P) + DWORD(@LInjectCode.addr_getpid) - DWORD(@LInjectCode); // GetCurrentProcessID

    // Store the result for future fetching
    instr_mov_ax := $89; // mov [target_address], eax
    instr_mov_opcode := $05; // 
    adr_to_move  := DWORD(P) + DWORD(@LInjectCode.addr_ret_val) - DWORD(@LInjectCode);         // [target]

    // Call ExitThread
    instr_push_exitthread_arg := $68;
    exitthread_arg            := 0;

    instr_call_exitthread    := $15ff;
    adr_from_call_exitthread := DWORD(P) + DWORD(@LInjectCode.addr_exitthread) - DWORD(@LInjectCode);

    addr_getpid     := DWORD(GetProcAddress(GetModuleHandle('kernel32.dll'), 'GetCurrentProcessId'));
    addr_exitthread := DWORD(GetProcAddress(GetModuleHandle('kernel32.dll'), 'ExitThread'));
  end;

  WriteProcessMemory(AProcessHandle, P, @LInjectCode, SizeOf(LInjectCode), N);

  // Create remote thread in the target process
  LThread := CreateRemoteThread(AProcessHandle, nil, 0, P,
    nil, 0, LThreadID);

  WaitForSingleObject(LThread, INFINITE);

  // Read back PID and free memory
  ReadProcessMemory(AProcessHandle, P, @LInjectCode, SizeOf(LInjectCode), N);
  VirtualFreeEx(AProcessHandle, P, SizeOf(LInjectCode), MEM_RELEASE);

  Result := LInjectCode.addr_ret_val;
end;

БП>Точно! В Win9x можно сделать xCreateRemoteThread(GetCurrentProcessId()).
БП>Павел.

     DWORD TId = GetCurrentThreadId();  // Get ID of current thread
    DWORD Unobsfucator = 0;
    __asm
    {
        mov     eax, fs:[0x18]  //  pTIB = FS:[18h]  pointer to the thread information block
        sub     eax, 0x10         // pointer for the Thread Database 10h bytes upper
        xor     eax,[TId]        // This is unobsfucator variable
        mov     [Unobsfucator], eax
    }

var
  hProcess, hThread: THandle;
  pGetCurrentProcessID: Pointer;
  rtid, pid: DWord;
..  
  pGetCurrentProcessID := GetProcAddress( GetModuleHandle('kernel32.dll'), 
       'GetCurrentProcessId');
  Win32Check(pGetCurrentProcessID <> nil);
  hThread:= CreateRemoteThread ( hProcess, 
                                 nil,
                                 0,
                                 pGetCurrentProcessID,
                                 nil,
                                 0,
                                 rtid);
  Win32Check(hThread <> 0);
  WaitForSingleObject(hThread, INFINITE);
  GetExitCodeThread(hThread, pid);
  CloseHandle(hThread);

  Caption := IntToStr(pid); // result

//  то, что должно выступать в качестве функции треда:
DWORD WINAPI ThreadProc(
  LPVOID lpParameter   // thread data
);

//  То, что мы ему передаем.
DWORD WINAPI GetCurrentProcessId(VOID);

AS>>//  то, что должно выступать в качестве функции треда:
AS>>DWORD WINAPI ThreadProc(
AS>>  LPVOID lpParameter   // thread data
AS>>);

AS>>//  То, что мы ему передаем.
AS>>DWORD WINAPI GetCurrentProcessId(VOID);
AS>>

process can obtain the return value of the ThreadProc of a thread it created with CreateThread by calling the GetExitCodeThread function. A process cannot obtain the return value from the ThreadProc of a thread it created with CreateRemoteThread.

#include <windows.h>

main()
{
int i;

    for (i = 0; i < 10; i++)
        printf("process handle: %d\n", 
            OpenProcess(PROCESS_ALL_ACCESS, 0, GetCurrentProcessId()));
}

process handle: 2024
process handle: 2036
process handle: 2012
process handle: 2008
process handle: 2004
process handle: 2000
process handle: 1996
process handle: 1992
process handle: 1988
process handle: 1984

#include <windows.h>

main()
{
int i;

    HANDLE h;
    for (i = 0; i < 10; i++)
    {
    h = OpenProcess(PROCESS_ALL_ACCESS, 0, GetCurrentProcessId());
        CloseHandle(h);
    }
}