Catch Startaddress with the Thread Module name of an external program

Question

I’m trying to differentiate the threads of a particular program. with "Processexplorer" software I can easily get through Start Address, since the method name appears:

I tried to catch Startaddress with this code in c#:

Process[] process = Process.GetProcessesByName("notepad");
foreach (ProcessThread CurrentThread in process[0].Threads)
{
     Console.WriteLine(CurrentThread.StartAddress);
}

and this was the result:

The Startaddress came all with the same value, so I tried to use this code:

                    IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)CurrentThread.Id);

                    if (pOpenThread != IntPtr.Zero)
                     {
                          var buf = Marshal.AllocHGlobal(IntPtr.Size);

                          int result = -1;
                          try
                          {
                              result = NtQueryInformationThread(pOpenThread, ThreadInfoClass.ThreadQuerySetWin32StartAddress, buf, IntPtr.Size, IntPtr.Zero);
                          }
                          finally
                          {
                              IntPtr CurrentThread = Marshal.ReadIntPtr(buf);
                              Console.WriteLine("TID: " + CurrentThread.Id + " StartAddress " + FinalResult);
                          }
                     }

and test was the result:

Solved my problem for a while but then the Startaddress changed... I need to get the name of the module to identify each Thread.

Answer 1

I do not know if it is exactly the information that appears in Processexplorer, but the process has the modules, the thread does not.

To get the module names as you ask the question, you can do so:

ProcessModuleCollection currentThreads = Process.GetProcessesByName("chrome")[0].Modules;

foreach (ProcessModule modulo in currentThreads)
{
    Console.WriteLine(modulo.ModuleName);
}

Upshot: