How to get module information based on thread number

After you get the thread, you can get handle through openthread, and then get the thread information through Zwqueryinformationthread.

Part1 Preparation:

#include <psapi.h>

#include <locale.h>

#include <iostream>

#pragmacomment (lib, "PSAPI.lib")

typedef enum _THREADINFOCLASS {

Threadbasicinformation,

Threadtimes,

ThreadPriority,

Threadbasepriority,

Threadaffinitymask,

Threadimpersonationtoken,

Threaddescriptortableentry,

Threadenablealignmentfaultfixup,

Threadeventpair_reusable,

Threadquerysetwin32startaddress,

Threadzerotlscell,

Threadperformancecount,

Threadamilastthread,

Threadidealprocessor,

Threadpriorityboost,

Threadsettlsarrayaddress,

Threadisiopending,

Threadhidefromdebugger,

Threadbreakontermination,

Maxthreadinfoclass

} Threadinfoclass;

typedef struct _CLIENT_ID {

HANDLE uniqueprocess;

HANDLE Uniquethread;

} client_id;

typedef client_id *PCLIENT_ID;

typedef struct _THREAD_BASIC_INFORMATION {//information Class 0

LONG Exitstatus;

PVOID tebbaseaddress;

client_id ClientId;

LONG Affinitymask;

LONG priority;

LONG basepriority;

} thread_basic_information, *pthread_basic_information;

extern "C" LONG (__stdcall *zwqueryinformationthread) (

In HANDLE Threadhandle,

In Threadinfoclass Threadinformationclass,

Out PVOID Threadinformation,

In ULONG Threadinformationlength,

Out Pulong returnlength OPTIONAL

) = NULL;

The preparation to be done in the main function:

SetLocale (Lc_all, ". ACP ");

HInstance Hntdll =:: GetModuleHandle (TEXT ("Ntdll"));

(farproc&) Zwqueryinformationthread =:: GetProcAddress (Hntdll, "Zwqueryinformationthread");

Part 2 getting related information

Thread_basic_information TBI;

PVOID startaddr;

LONG status;

HANDLE thread, process;

Thread =:: Openthread (Thread_all_access, FALSE, dwThreadID);

if (thread = = NULL)

{

printf ("Cannot open thread handle\n");

return FALSE;

}

Status = Zwqueryinformationthread (thread,threadquerysetwin32startaddress, &startaddr, sizeof (STARTADDR), NULL);

if (Status < 0)

{

CloseHandle (thread);

printf ("Cannot get status1\n");

return FALSE;

};

printf ("Thread%08x start address is%p\n", dwThreadID, STARTADDR);

Status = Zwqueryinformationthread (thread,

Threadbasicinformation,

&TBI,

sizeof (TBI),

NULL);

if (Status < 0)

{

CloseHandle (thread);

printf ("Cannot get status2\n");

return FALSE;

};

printf ("Thread%08x process ID is%08x\n", dwThreadID, (DWORD) TBI. clientid.uniqueprocess);

Process =:: OpenProcess (Process_all_access,

FALSE,

(DWORD) TBI. clientid.uniqueprocess);

if (process = = NULL)

{

DWORD error =:: GetLastError ();

CloseHandle (thread);

SetLastError (Error);

return FALSE;

};

TCHAR ModName [0x100];

:: Getmodulefilenameex (Process, NULL, ModName, 0x100);

printf ("Thread%08x process image is%s\n", dwThreadID, ModName);

Getmappedfilename (Process,

STARTADDR,

ModName,

0x100);

std::string stname (pName);

std::string stmodname (ModName);

if (Stmodname.find (stname)! = Std::string::npos)

{

printf ("Thread%08x executable code module is%s\n", dwThreadID, ModName);

ret = TRUE;

}

CloseHandle (process);

CloseHandle (thread);

How to get module information based on thread number