I want to get the start address of a thread using it’s ID. Is it possible?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Well, this is not really trivial for the following reason: in the Win32 subsystem all threads have the same start address. In Windows up to (but not including) Vista it was inside
kernel32.dll(namedBaseThreadStartThunkaccording to the official symbols). In Windows versions starting with Vista, the common start address is nowRtlUserThreadStartinntdll.dll(andBaseThreadStartThunkgot renamed toBaseThreadInitThunkand seemingly only does the Win32-specific tasks now).However, what you could attempt is to suspend the thread, retrieve its
CONTEXT(usingGetThreadContext) and from that traverse the stack back to its top to investigate the parameters there. It will require some reverse-engineering of each implementation of thekernel32.dllthread start routine, but it should be doable.An alternative is to use the undocumented native API
NtQueryInformationThreadwithThreadQuerySetWin32StartAddress. There is also an MSDN page about the function, but it is far from complete.