Home/ Questions/Q 3275022
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-17T19:06:01+00:00

I enumerate all threads in a process through the CreateToolhelp32Snapshot function. I would like

  • 0

I enumerate all threads in a process through the CreateToolhelp32Snapshot function. I would like to get some basic stack information for each thread. More specifically I would like to get stack bottom address and if possible I would like to get current stack top address. Basically this is the information displayed with the ~*k command in WinDbg. So how can I obtain the stack information from the thread’s ID or HANDLE?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    (Definitions can be found here.)

    To get stack boundaries:

    THREAD_BASIC_INFORMATION basicInfo;
NT_TIB tib;

// Get TEB address
NtQueryInformationThread(YOUR_THREAD_HANDLE, ThreadBasicInformation, &basicInfo, sizeof(THREAD_BASIC_INFORMATION), NULL);
// Read TIB
NtReadVirtualMemory(YOUR_PROCESS_HANDLE, basicInfo.TebBaseAddress, &tib, sizeof(NT_TIB), NULL);
// Check tib.StackBase and tib.StackLimit

    To get the value of esp, simply use GetThreadContext.

    • 0