Get thread start address - multithreading

Question

I'm writing a process viewer, its 99% complete, I just need get the start address of a process' thread, but I don't know how do it.
Can anyone help-me? :/
Thx

Answer 1

You can use the NtQueryInformationThread function passing the ThreadQuerySetWin32StartAddress value of the THREAD_INFORMATION_CLASS enumeration as parameter.
check this sample app
{$APPTYPE CONSOLE}
{$R *.res}
uses
TlHelp32,
Windows,
SysUtils;
const
THREAD_QUERY_INFORMATION = $0040;
STATUS_SUCCESS = $00000000;
ThreadQuerySetWin32StartAddress = 9;
type
NTSTATUS = LONG;
THREADINFOCLASS = DWORD;
function NtQueryInformationThread(
ThreadHandle: THandle; ThreadInformationClass: THREADINFOCLASS;
ThreadInformation: Pointer; ThreadInformationLength: ULONG; ReturnLength: PULONG): NTSTATUS; stdcall; external 'ntdll.dll';
function OpenThread(dwDesiredAccess: DWord;
bInheritHandle: Bool;
dwThreadId: DWord): DWord; stdcall; external 'kernel32.dll';
function GetThreadStartAddress(th32ThreadID : DWORD) : Pointer;
var
hThread : THandle;
ThreadStartAddress : Pointer;
begin
Result:=0;
hThread := OpenThread(THREAD_QUERY_INFORMATION , false, th32ThreadID);
if (hThread = 0) then RaiseLastOSError;
try
if NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, #ThreadStartAddress, SizeOf(ThreadStartAddress), nil) = STATUS_SUCCESS then
Result:=ThreadStartAddress
else
RaiseLastOSError;
finally
CloseHandle(hThread);
end;
end;
function GetThreadsList(th32ProcessID:DWORD): Boolean;
var
hSnapshot : THandle;
NextThread : Boolean;
TThreadEntry : TThreadEntry32;
begin
hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); //Takes a snapshot of the all threads
Result := (hSnapshot <> INVALID_HANDLE_VALUE);
if Result then
try
TThreadEntry.dwSize := SizeOf(TThreadEntry);
NextThread := Thread32First(hSnapshot, TThreadEntry);//get the first Thread
while NextThread do
begin
if TThreadEntry.th32OwnerProcessID = th32ProcessID then //Check the owner Pid against the PID requested
Writeln(Format('Thread Id %.8x Start Address %p',[TThreadEntry.th32ThreadID, GetThreadStartAddress(TThreadEntry.th32ThreadID)]));
NextThread := Thread32Next(hSnapshot, TThreadEntry);//get the Next Thread
end;
finally
CloseHandle(hSnapshot);
end;
end;
begin
try
GetThreadsList(4028);
except
on E: Exception do
Writeln(E.ClassName, ': ', E.Message);
end;
readln;
end.
Note : to get access to some system process you will need set SeDebugPrivilege privilege in your app.