1

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API.

enter image description here

I'm search all web, and I find little bit code pieces. I compile and run my program, but thread start address is always being 0x00000 or 0xccccc. Where I do mistake? My Thread Start Address Finder function is here:

#define ThreadQuerySetWin32StartAddress 9

typedef NTSTATUS(WINAPI* NTQUERYINFOMATIONTHREAD)(HANDLE, LONG, PVOID, ULONG, PULONG);
DWORD WINAPI GetThreadStartAddress(__in HANDLE hThread)
{
    NTSTATUS ntStatus;
    DWORD dwThreadStartAddr = 0;
    NTQUERYINFOMATIONTHREAD NtQueryInformationThread;

    if ((NtQueryInformationThread = (NTQUERYINFOMATIONTHREAD)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationThread"))) {
        ntStatus = NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &dwThreadStartAddr, sizeof(DWORD), NULL);
    }

    return dwThreadStartAddr;
}
1
  • Iirc this api is documented include winternl.h second iirc for this threadinfoclass you need sizeof(pvoid) not sizeof(dword). And check returned bytes , ntstatus etc compile with w4 and /analyze. Also check dbgeng.h the dbgeng has methods to retrieve this – blabb May 31 at 15:21
1

Like I Commented this function is documented in winternl.h and you can use ntdll.lib to link with also start address being a pointer will need 8 bytes in x64

#include <windows.h>
#include <winternl.h>
#include <stdio.h>

int main(void)
{
    ULONG64 Tinfo = 0;
    ULONG retlen = 0;
    NTSTATUS ntqitret = NtQueryInformationThread(GetCurrentThread(), (THREADINFOCLASS)9,
    &Tinfo, sizeof(PVOID), &retlen);
    printf("START  = %I64x\nret    = %x\nretlen = %x\n",Tinfo, ntqitret, retlen );
}

compiling ,executing , comparing

:>cl /Zi /W4 /analyze /Od /EHsc /nologo ntqit.cpp /link /release ntdll.lib
ntqit.cpp

:>ntqit.exe
START  = 7ff73b0d1434
ret    = 0
retlen = 8

:>cdb -c "x ntqit!*maincrt*;q" ntqit.exe | awk "/Reading/,/quit:/"
0:000> cdb: Reading initial command 'x ntqit!*maincrt*;q'
00007ff7`3b0d1434 ntqit!mainCRTStartup (void)
quit:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.