Get ModuleNeme from ProcessThread.StartAddress

Asked Sep 21 '15 at 15:21

Active Sep 21 '15 at 16:27

Viewed 189 times

ProcessThread.StartAddress is the memory address of the function that the operating system called that started this thread.

How I get the function name and Module name?

for get function name I found SymFromAddr but for Module name I need help.

edited Sep 21 '15 at 16:27

asked Sep 21 '15 at 15:21

codeDom

1

You can just hard-code it. The module name is ntdll.dll, the function name is RtlUserThreadStart(). ProcessThread.StartAddress is only useful in old Windows versions, XP was the last one. – Hans Passant Sep 21 '15 at 18:00

0 Answers0