Jump to content

Thread address.


eracross
 Share

Recommended Posts

You'll need to open a thread handle with THREAD_QUERY_INFORMATION access, and you can retrieve the start address using something along the lines of the below code. (Note '-2' is a pseudo-handle to the current thread):

Local $iPtrSz=4,$aRet,$hThread=Ptr(-2)
If @AutoItX64 Then $iPtrSz*=2
$aRet=DllCall("ntdll.dll","long","NtQueryInformationThread","handle",$hThread,"int",9,"ptr*",0,"ulong",$iPtrSz,"ulong*",0)
If Not @error And $aRet[0]=0 And $aRet[5]=$iPtrSz Then
    ConsoleWrite("Start address:"&$aRet[3]&@CRLF)
Else
    ConsoleWrite("Error getting start address"&@CRLF)
EndIf

*edit: added @error check

Edited by Ascend4nt
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...