如何根據線程號獲取模塊信息

在得到線程之后，便可以通過openThread得到HANDLE，之后通過ZwQueryInformationThread獲取線程信息。

Part1 準備：

#include <psapi.h>

#include <locale.h>

#include <iostream>

#pragma comment(lib,"psapi.lib")  

typedef enum _THREADINFOCLASS {

    ThreadBasicInformation,

    ThreadTimes,

    ThreadPriority,

    ThreadBasePriority,

    ThreadAffinityMask,

    ThreadImpersonationToken,

    ThreadDescriptorTableEntry,

    ThreadEnableAlignmentFaultFixup,

    ThreadEventPair_Reusable,

    ThreadQuerySetWin32StartAddress,

    ThreadZeroTlsCell,

    ThreadPerformanceCount,

    ThreadAmILastThread,

    ThreadIdealProcessor,

    ThreadPriorityBoost,

    ThreadSetTlsArrayAddress,

    ThreadIsIoPending,

    ThreadHideFromDebugger,

    ThreadBreakOnTermination,

    MaxThreadInfoClass

} THREADINFOCLASS;

typedef struct _CLIENT_ID {

    HANDLE UniqueProcess;

    HANDLE UniqueThread;

} CLIENT_ID;

typedef CLIENT_ID *PCLIENT_ID;

typedef struct _THREAD_BASIC_INFORMATION { // Information Class 0

    LONG     ExitStatus;

    PVOID    TebBaseAddress;

    CLIENT_ID ClientId;

    LONG AffinityMask;

    LONG Priority;

    LONG BasePriority;

} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

extern "C" LONG (__stdcall *ZwQueryInformationThread) (

    IN HANDLE ThreadHandle,

    IN THREADINFOCLASS ThreadInformationClass,

    OUT PVOID ThreadInformation,

    IN ULONG ThreadInformationLength,

    OUT PULONG ReturnLength OPTIONAL

    ) = NULL;

主函數中需要做的準備工作：

    setlocale (LC_ALL, ".ACP");

    HINSTANCE hNTDLL = ::GetModuleHandle (TEXT ("ntdll"));

    (FARPROC&)ZwQueryInformationThread  = ::GetProcAddress (hNTDLL,   "ZwQueryInformationThread");

Part 2 獲取相關信息

    THREAD_BASIC_INFORMATION    tbi;

    PVOID                       startaddr;

    LONG                        status;

    HANDLE                      thread, process;

    thread = ::OpenThread (THREAD_ALL_ACCESS, FALSE, dwThreadId);

    if (thread == NULL)

{

printf("cannot open thread handle\n");

        return FALSE;

}

status = ZwQueryInformationThread(thread,ThreadQuerySetWin32StartAddress, &startaddr, sizeof (startaddr), NULL);

    if (status < 0)

    {

        CloseHandle (thread);

printf("cannot get status1\n");

        return FALSE;

    };

    printf("線程 %08x 的起始地址為 %p\n", dwThreadId, startaddr);

    status = ZwQueryInformationThread (thread, 

            ThreadBasicInformation, 

            &tbi, 

            sizeof (tbi), 

            NULL);

    if (status < 0)

{

        CloseHandle (thread);

printf("cannot get status2\n");

        return FALSE;

};

printf("線程 %08x 所在進程ID為 %08x\n", dwThreadId, (DWORD)tbi.ClientId.UniqueProcess);

process = ::OpenProcess (PROCESS_ALL_ACCESS, 

FALSE, 

(DWORD)tbi.ClientId.UniqueProcess);

if (process == NULL)

{

DWORD error = ::GetLastError ();

CloseHandle (thread);

SetLastError (error);

return FALSE;

};

TCHAR modname [0x100];

::GetModuleFileNameEx (process, NULL, modname, 0x100);

printf("線程 %08x 所在進程映象為 %s\n", dwThreadId, modname);

GetMappedFileName(process, 

startaddr, 

modname, 

0x100);

        std::string stName(pName);

std::string stModName(modname);

if(stModName.find(stName) != std::string::npos)

{

printf("線程 %08x 可執行代碼所在模塊為 %s\n", dwThreadId, modname);

ret = TRUE;

}

CloseHandle (process);

CloseHandle (thread);