windows下如何获取线程的起始地址?

2024-04-25

I'm working on a mini windows process explorer in C, I have a handle to a thread.
How can I retrieve starting address of that thread? Something like this:
enter image description here


几天前就已经有人问过这样的问题了。这是一个示例解决方案:

DWORD WINAPI GetThreadStartAddress(HANDLE hThread)
{
    NTSTATUS ntStatus;
    HANDLE hDupHandle;
    DWORD dwStartAddress;

    pNtQIT NtQueryInformationThread = (pNtQIT)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryInformationThread");

    if(NtQueryInformationThread == NULL) 
        return 0;

    HANDLE hCurrentProcess = GetCurrentProcess();
    if(!DuplicateHandle(hCurrentProcess, hThread, hCurrentProcess, &hDupHandle, THREAD_QUERY_INFORMATION, FALSE, 0)){
        SetLastError(ERROR_ACCESS_DENIED);

        return 0;
    }

    ntStatus = NtQueryInformationThread(hDupHandle, ThreadQuerySetWin32StartAddress, &dwStartAddress, sizeof(DWORD), NULL);
    CloseHandle(hDupHandle);
    if(ntStatus != STATUS_SUCCESS) 
       return 0;

    return dwStartAddress;

}

Source: http://forum.sysinternals.com/how-to-get-the-start-address-and-modu_topic5127_post18072.html#18072 http://forum.sysinternals.com/how-to-get-the-start-address-and-modu_topic5127_post18072.html#18072

您可能必须包含此文件:http://pastebin.com/ieEqR0eL http://pastebin.com/ieEqR0eL

相关问题:如何使用LoadLibrary()和GetProcAddress()函数将ntdll.dll添加到项目库中? https://stackoverflow.com/questions/11120710/how-to-add-ntdll-dll-to-project-libraries-with-loadlibrary-and-getprocaddress/11121140#11121140

本文内容由网友自发贡献,版权归原作者所有,本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容,请联系:hwhale#tublm.com(使用前将#替换为@)

windows下如何获取线程的起始地址? 的相关文章

随机推荐