线程入口地址 类封装

#pragma once
typedef LONG NTSTATUS;
typedef NTSTATUS(WINAPI *NTQUERYINFORMATIONTHREAD)(
	HANDLE ThreadHandle,
	ULONG ThreadInformationClass,
	PVOID ThreadInformation,
	ULONG ThreadInformationLength,
	PULONG ReturnLength);
typedef enum _THREADINFOCLASS {
	ThreadBasicInformation,
	ThreadTimes,
	ThreadPriority,
	ThreadBasePriority,
	ThreadAffinityMask,
	ThreadImpersonationToken,
	ThreadDescriptorTableEntry,
	ThreadEnableAlignmentFaultFixup,
	ThreadEventPair_Reusable,
	ThreadQuerySetWin32StartAddress,
	ThreadZeroTlsCell,
	ThreadPerformanceCount,
	ThreadAmILastThread,
	ThreadIdealProcessor,
	ThreadPriorityBoost,
	ThreadSetTlsArrayAddress,   // Obsolete
	ThreadIsIoPending,
	ThreadHideFromDebugger,
	ThreadBreakOnTermination,
	ThreadSwitchLegacyState,
	ThreadIsTerminated,
	ThreadLastSystemCall,
	ThreadIoPriority,
	ThreadCycleTime,
	ThreadPagePriority,
	ThreadActualBasePriority,
	ThreadTebInformation,
	ThreadCSwitchMon,          // Obsolete
	ThreadCSwitchPmu,
	ThreadWow64Context,
	ThreadGroupInformation,
	ThreadUmsInformation,      // UMS
	ThreadCounterProfiling,
	ThreadIdealProcessorEx,
	MaxThreadInfoClass
} THREADINFOCLASS;

class FindThreadStaAddr
{
public:
	FindThreadStaAddr(void);
	~FindThreadStaAddr(void);
	DWORD GetThreadStartAddr1(DWORD dwThreadId);
};
extern int biaohao1;
#include "StdAfx.h"
#include "FindThreadStaAddr.h"
DWORD xianchengid_fuben = 0;
int biaohao1 = 0;
FindThreadStaAddr::FindThreadStaAddr(void)
{
}

FindThreadStaAddr::~FindThreadStaAddr(void)
{
}


DWORD FindThreadStaAddr::GetThreadStartAddr1(DWORD dwThreadId)
{
	xianchengid_fuben = dwThreadId;
	HMODULE hNtdll = LoadLibrary(_T("ntdll.dll"));
	if (!hNtdll)
	{
		return 0;
	}
	//TRACE("\n李赛赛%d------------------------------", xianchengid_fuben);
	NTQUERYINFORMATIONTHREAD NtQueryInformationThread = NULL;
	NtQueryInformationThread = (NTQUERYINFORMATIONTHREAD)
		GetProcAddress(hNtdll, "NtQueryInformationThread");
	if (!NtQueryInformationThread)
	{
		return 0;
	}

	HANDLE ThreadHandle = NULL;
	ThreadHandle = OpenThread(THREAD_QUERY_INFORMATION, FALSE, dwThreadId);
	if (!ThreadHandle)
	{
		return 0;
	}

	DWORD dwStaAddr = NULL;
	DWORD dwReturnLength = 0;
	//if (NtQueryInformationThread(ThreadHandle, ThreadQuerySetWin32StartAddress,
	//	&dwStaAddr, sizeof(dwStaAddr), &dwReturnLength))
	//{
	//	return 0;
	//}
	NtQueryInformationThread(ThreadHandle, ThreadQuerySetWin32StartAddress, &dwStaAddr, sizeof(dwStaAddr), &dwReturnLength);
	TRACE("\n李赛赛%x------------------------------", dwStaAddr);
	//if (dwStaAddr == 0x5cb091f0)
	//{
	//	return xianchengid_fuben;
	//}
	if (dwStaAddr == 0x00bed3b8)
	{
		biaohao1 = 1;
		return xianchengid_fuben;
	}
	//return dwThreadId;
	//return dwStaAddr;//返回开始地址
	return 0;
}