How to get the name of the related DLL for a thread in a process like Process Explorer in C#?

1. I use Process[] _processlist = Process.GetProcesses(); to get all the processes running.

2. I use ProcessThreadCollection _processthreadcollection = _processlist[0].Threads ( in a foreach loop in my code ) to get the threads each process uses.

Now, I can get the process id and thread id but I don't know how to get the DLL/EXE/FUNCTION name of the threads?

In "Process Explorer" if you double click on a process and go to "Threads" tab, you get a list of all thread and in "Start Address" you can see which DLL is each thread related to.

But in C# code the start address of each thread is just a pointer not a string. I wonder how "Process Explorer" does it? Any chance someone here could write a small C# sample code for me?

I would GREATLY appreciate it.

http://msdn.microsoft.com/en-us/library/system.diagnostics.processmodule

http://msdn.microsoft.com/en-us/library/system.diagnostics.processthread

Pointer addresses can be converted to integers.

Does that help?

Ok I think I found something that helps:

http://stackoverflow.com/questions/8679406/get-startaddress-of-win32-thread-from-another-process

I was led to that by finding the following, and realizing you needed the symbol name for the thread's entry point:

http://stackoverflow.com/questions/5157083/getting-module-name-from-thread-information

The question asker in the first link says it works on getting the symbol name if he has the correct start address.

http://msdn.microsoft.com/en-us/library/windows/desktop/ms681323(v=vs.85).aspx">http://msdn.microsoft.com/en-us/library/windows/desktop/ms681323(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/windows/desktop/ms681351(v=vs.85).aspx">http://msdn.microsoft.com/en-us/library/windows/desktop/ms681351(v=vs.85).aspx

That's using Interop though.

I looked for an equivalent method in the C# Diagnostics namespace, all I could find was StackTrace and StackFrame, which seems to do that , but only for managed threads, not OS threads. 

If you're trying to get the list of all modules (i.e. DLLs and EXEs) in a given process, look at http://msdn.microsoft.com/en-us/library/windows/desktop/ms682631(v=vs.85).aspx">http://msdn.microsoft.com/en-us/library/windows/desktop/ms682631(v=vs.85).aspx (you'll need to use PInvoke to access it if you're in C#).

If you merely want the name of the process that a current thread is in, you'll need to call

SuspendThread() on the thread that you're interrogating.

Call GetThreadContext() on that thread to find out its current register state

Look at Context.Eip (for 32-bit) or Context.Rip (for 64-bit) for the thread.

Correlate that EIP value against the module list you've just obtained to see if it lies inside any of the modules. If it does - you've found your man, otherwise you're currently running from JITted code.

If you want an exact method name, you'll need debugging symbols for the module you're debugging. Pass the EIP value (from before) into GetSymbolName to get a "best-match" name for the value (this might help: http://stackoverflow.com/questions/5705650/stackwalk64-on-windows-get-symbol-name).

SysInternals uses DbgHelp.dll and GetSymbolName on values obtained from Context.Esp (the stack), so if you want to have information that looks the same as the screenshot you've got, take a stack-trace using Context.Esp and GetSymbolName as described above.

I think what "evildictator" said about DbgHelp.dll and GetSymbolName from Context.Esp seems  what I need. Now, if any of you could only help me with an actual sample it would be a dream for me! I am in real trouble because my vacation time is so short.

Of couse, I stand by this, whoever delivers it first: http://channel9.msdn.com/Forums/Coffeehouse/100-bounty-for-code-serious-offer

http://msdn.microsoft.com/en-us/library/windows/desktop/ms681323%28v=vs.85%29.aspx

Here is a C++ code of it but I have ZERO idea how to use/convert this in C#:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms680578(v=vs.85).aspx

OK, I found this nice code a DbgHelp wrapper:

http://www.koders.com/csharp/fidAB470706CB5969E4C035A4ED5335B647A1B82DB8.aspx?s=search

But can anyone show me how to use the SymFromAddr function?

I cannot get it to work to get name for processthread, this is what I do:

IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)_processthread.Id);

DbgHelp.SymInitialize(pOpenThread, null, true);

DbgHelp.SYMBOL_INFO _symbol = new DbgHelp.SYMBOL_INFO();

ulong ul = new ulong();

DbgHelp.SymFromAddr(pOpenThread, (ulong)(_processthread.StartAddress),ref ul, ref _symbol);

"_symbol" variable comes out all empty.

"ProgrammerCS" is not really interested in this project. We just spoke briefly on IRC and he was curious to help me. He told me about this thread so I came here to first thank everyone for their help and secondly, regarding the code. The final code has not yet been received in a working way. Once I receive it, I will ask permission from the guy who helped me and hopefully, I will be able to post the source code here for everyone.

Thanks again.

Regards P. D.

The code doesn't seem to work. It doesn't list everything and it definitely is not working in Windows 8. I have emailed Mark @ sysinternals and asked him if he could show me a sample. So far, no answer.

This problem seems impossible to solve! Such a simple task, so impossible, so complex and NO ONE can do it.

3 hours ago, PeterDouglas wrote

Hey guys,

The code doesn't seem to work. It doesn't list everything and it definitely is not working in Windows 8. I have emailed Mark @ sysinternals and asked him if he could show me a sample. So far, no answer.

This problem seems impossible to solve! Such a simple task, so impossible, so complex and NO ONE can do it.

PETER !

Not once did you mention this was for Windows 8.  

The API is changing so you may want to look at the current Windows 8 list for direction: http://msdn.microsoft.com/en-us/library/hh448382(v=vs.85).aspx">http://msdn.microsoft.com/en-us/library/hh448382(v=vs.85).aspx

@JohnAskew: Is there ANY chance you can give a C# sample?

Serious offer, I will pay money for a working sample.

3 days ago, PeterDouglas wrote

I SEE!!!!

@JohnAskew: Is there ANY chance you can give a C# sample?

I don't have Windows 8 loaded anywhere yet.

http://channel9.msdn.com/Forums/Coffeehouse/Inspiration#cf45aa970baeb4bb49d6ca0ac00e2659e