几天前就已经有人问过这样的问题了。这是一个示例解决方案:
DWORD WINAPI GetThreadStartAddress(HANDLE hThread)
{
NTSTATUS ntStatus;
HANDLE hDupHandle;
DWORD dwStartAddress;
pNtQIT NtQueryInformationThread = (pNtQIT)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryInformationThread");
if(NtQueryInformationThread == NULL)
return 0;
HANDLE hCurrentProcess = GetCurrentProcess();
if(!DuplicateHandle(hCurrentProcess, hThread, hCurrentProcess, &hDupHandle, THREAD_QUERY_INFORMATION, FALSE, 0)){
SetLastError(ERROR_ACCESS_DENIED);
return 0;
}
ntStatus = NtQueryInformationThread(hDupHandle, ThreadQuerySetWin32StartAddress, &dwStartAddress, sizeof(DWORD), NULL);
CloseHandle(hDupHandle);
if(ntStatus != STATUS_SUCCESS)
return 0;
return dwStartAddress;
}
Source: http://forum.sysinternals.com/how-to-get-the-start-address-and-modu_topic5127_post18072.html#18072 http://forum.sysinternals.com/how-to-get-the-start-address-and-modu_topic5127_post18072.html#18072
您可能必须包含此文件:http://pastebin.com/ieEqR0eL http://pastebin.com/ieEqR0eL
相关问题:如何使用LoadLibrary()和GetProcAddress()函数将ntdll.dll添加到项目库中? https://stackoverflow.com/questions/11120710/how-to-add-ntdll-dll-to-project-libraries-with-loadlibrary-and-getprocaddress/11121140#11121140