How to find the entry point of a specific thread in Windows?

Question

I'm trying to figure out how to find the entry point of a specific thread in Windows. I know of various ways to get the entry point of a process, but not of a thread. I've looked at a few different structures/methods (TIB, PEB, and GetThreadContext) that might be able to access it, but it doesn't seem that they do. I've also checked out the CREATE_THREAD_DEBUG_INFO info structure -- which has access to the start routine -- but it seems that the only way to populate it is by actively debugging the process and calling WaitForDebugEvent. Any ideas?

Thanks!

Answer 1

Use NtQueryInformationThread with ThreadQuerySetWin32StartAddress:

http://msdn.microsoft.com/en-us/library/ms684283%28VS.85%29.aspx

Answer 2

I'd try:

• putting a breakpoint on CreateThread
• examining exe file in IDA Pro (I'm pretty sure there was a free version of it)