windows - How to retrieve start address of a thread using its ID? -
i want start address of thread using it's id. possible?
well, not trivial following reason: in win32 subsystem all threads have same start address. in windows (but not including) vista inside kernel32.dll (named basethreadstartthunk according official symbols). in windows versions starting vista, common start address rtluserthreadstart in ntdll.dll (and basethreadstartthunk got renamed basethreadinitthunk , seemingly win32-specific tasks now).
however, attempt suspend thread, retrieve context (using getthreadcontext) , traverse stack top investigate parameters there. require reverse-engineering of each implementation of kernel32.dll thread start routine, should doable.
an alternative use undocumented native api ntqueryinformationthread threadquerysetwin32startaddress. there an msdn page function, far complete.
Comments
Post a Comment