VC++.线程入口

typedef LONG NTSTATUS;
typedef LONG KPRIORITY;
#define STATUS_SUCCESS                  ((NTSTATUS) 0x00000000)
#define NT_SUCCESS(Status)              ((NTSTATUS)(Status) >= 0)
#define STATUS_INFO_LENGTH_MISMATCH     ((NTSTATUS)0xC0000004L)
typedef enum _THREADINFOCLASS {
	ThreadBasicInformation,
	ThreadTimes,
	ThreadPriority,
	ThreadBasePriority,
	ThreadAffinityMask,
	ThreadImpersonationToken,
	ThreadDescriptorTableEntry,
	ThreadEnableAlignmentFaultFixup,
	ThreadEventPair_Reusable,
	ThreadQuerySetWin32StartAddress,
	ThreadZeroTlsCell,
	ThreadPerformanceCount,
	ThreadAmILastThread,
	ThreadIdealProcessor,
	ThreadPriorityBoost,
	ThreadSetTlsArrayAddress,
	ThreadIsIoPending,
	ThreadHideFromDebugger,
	ThreadBreakOnTermination,
	ThreadSwitchLegacyState,
	ThreadIsTerminated,
	MaxThreadInfoClass
} THREADINFOCLASS;
typedef NTSTATUS (__stdcall *ZWQUERYINFORMATIONTHREAD)(
	__in HANDLE ThreadHandle,
	__in THREADINFOCLASS ThreadInformationClass,
	__out_bcount(ThreadInformationLength) PVOID ThreadInformation,
	__in ULONG ThreadInformationLength,
	__out_opt PULONG ReturnLength
);
DWORD GetThreadEntry(IN DWORD dwTid)
{
	DWORD ret = 0;
	try
	{
		ZWQUERYINFORMATIONTHREAD ZwQueryInformationThread = (ZWQUERYINFORMATIONTHREAD)GetProcAddress(LoadLibrary(_T("ntdll.dll")), "ZwQueryInformationThread");
		if (ZwQueryInformationThread)
		{
			HANDLE hThread = OpenThread(THREAD_QUERY_INFORMATION, 0, dwTid);
			if (hThread)
			{
				DWORD dw = 0;
				ZwQueryInformationThread(hThread,
					ThreadQuerySetWin32StartAddress, //THREADINFOCLASS ThreadQuerySetWin32StartAddress, //9 查询线程入口地址 
					&ret,
					sizeof(ret),
					&dw);
				CloseHandle(hThread);
			}
		}
	}
	catch (...)
	{
		OutputDebugStringA(__FUNCTION__);
		return 0;
	}
	return ret;
}

#include <TlHelp32.h>
#include <vector>
BOOL TraversalThread1(OUT std::vector<THREADENTRY32> &vec)
{
	/************************************************************************/
	/*
	typedef struct tagTHREADENTRY32
	{
	DWORD   dwSize;
	DWORD   cntUsage;
	DWORD   th32ThreadID;       // this thread
	DWORD   th32OwnerProcessID; // Process this thread is associated with
	LONG    tpBasePri;
	LONG    tpDeltaPri;
	DWORD   dwFlags;
	} THREADENTRY32;
	*/
	/************************************************************************/
	vec.clear();
	try
	{
		HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
		if (hSnap != INVALID_HANDLE_VALUE)
		{
			THREADENTRY32 item;
			item.dwSize = sizeof(item);
			if (Thread32First(hSnap, &item))
			{
				do
				{
					vec.push_back(item);
				} while (Thread32Next(hSnap, &item));
			}
			CloseHandle(hSnap);
		}
	}
	catch (...)
	{
		OutputDebugStringA(__FUNCTION__);
		return 0;
	}
	return vec.size() > 0;
}

int main()
{
	std::vector<THREADENTRY32> vec;
	std::cout << TraversalThread1(vec) << endl;
	INT ret = 0;
	for each (THREADENTRY32 var in vec)
	{
		ret = GetThreadEntry(var.th32ThreadID);
		//if (12212 == var.th32OwnerProcessID)
		//{
		//	printf("%08X %08X|%d %08X", var.th32ThreadID, var.th32OwnerProcessID, var.th32OwnerProcessID, ret);
		//	printf("\r\n");
		//}
		printf("%08X %08X|%d %08X", var.th32ThreadID, var.th32OwnerProcessID, var.th32OwnerProcessID, ret);
		printf("\r\n");
	}

	return 0;
}