How to get thread start address in Windows?

Question

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API.

I'm search all web, and I find little bit code pieces. I compile and run my program, but thread start address is always being 0x00000 or 0xccccc. Where I do mistake? My Thread Start Address Finder function is here:

#define ThreadQuerySetWin32StartAddress 9

typedef NTSTATUS(WINAPI* NTQUERYINFOMATIONTHREAD)(HANDLE, LONG, PVOID, ULONG, PULONG);
DWORD WINAPI GetThreadStartAddress(__in HANDLE hThread)
{
    NTSTATUS ntStatus;
    DWORD dwThreadStartAddr = 0;
    NTQUERYINFOMATIONTHREAD NtQueryInformationThread;

    if ((NtQueryInformationThread = (NTQUERYINFOMATIONTHREAD)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationThread"))) {
        ntStatus = NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &dwThreadStartAddr, sizeof(DWORD), NULL);
    }

    return dwThreadStartAddr;
}

Answer 1

Like I Commented this function is documented in winternl.h and you can use ntdll.lib to link with also start address being a pointer will need 8 bytes in x64

#include <windows.h>
#include <winternl.h>
#include <stdio.h>

int main(void)
{
    ULONG64 Tinfo = 0;
    ULONG retlen = 0;
    NTSTATUS ntqitret = NtQueryInformationThread(GetCurrentThread(), (THREADINFOCLASS)9,
    &Tinfo, sizeof(PVOID), &retlen);
    printf("START  = %I64x\nret    = %x\nretlen = %x\n",Tinfo, ntqitret, retlen );
}

compiling ,executing , comparing

:>cl /Zi /W4 /analyze /Od /EHsc /nologo ntqit.cpp /link /release ntdll.lib
ntqit.cpp

:>ntqit.exe
START  = 7ff73b0d1434
ret    = 0
retlen = 8

:>cdb -c "x ntqit!*maincrt*;q" ntqit.exe | awk "/Reading/,/quit:/"
0:000> cdb: Reading initial command 'x ntqit!*maincrt*;q'
00007ff7`3b0d1434 ntqit!mainCRTStartup (void)
quit: