OK, I found this nice code a DbgHelp wrapper:

http://www.koders.com/csharp/fidAB470706CB5969E4C035A4ED5335B647A1B82DB8.aspx?s=search

But can anyone show me how to use the SymFromAddr function?

I cannot get it to work to get name for processthread, this is what I do:

IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)_processthread.Id);

DbgHelp.SymInitialize(pOpenThread, null, true);

DbgHelp.SYMBOL_INFO _symbol = new DbgHelp.SYMBOL_INFO();

ulong ul = new ulong();

DbgHelp.SymFromAddr(pOpenThread, (ulong)(_processthread.StartAddress),ref ul, ref _symbol);

"_symbol" variable comes out all empty.

http://msdn.microsoft.com/en-us/library/windows/desktop/ms681323%28v=vs.85%29.aspx

Here is a C++ code of it but I have ZERO idea how to use/convert this in C#:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms680578(v=vs.85).aspx

I think what "evildictator" said about DbgHelp.dll and GetSymbolName from Context.Esp seems  what I need. Now, if any of you could only help me with an actual sample it would be a dream for me! I am in real trouble because my vacation time is so short.

Of couse, I stand by this, whoever delivers it first: http://channel9.msdn.com/Forums/Coffeehouse/100-bounty-for-code-serious-offer

4 hours ago, felix9 wrote

DbgHelp.dll ???

Yes but I need a working sample in order for you to "win" the $100.

I am not rich but I can offer $100 to anyone who can solve this issue for me:

http://channel9.msdn.com/Forums/TechOff/How-to-get-the-name-of-the-related-DLL-for-a-thread-in-a-process-like-Process-Explorer/

I am totally lost and cannot solve this issue by myself so I thought Channel9 is the best place to get help on this.

How to get the name of the related DLL for a thread in a process like Process Explorer in C#?

1. I use Process[] _processlist = Process.GetProcesses(); to get all the processes running.

2. I use ProcessThreadCollection _processthreadcollection = _processlist[0].Threads ( in a foreach loop in my code ) to get the threads each process uses.

Now, I can get the process id and thread id but I don't know how to get the DLL/EXE/FUNCTION name of the threads?

In "Process Explorer" if you double click on a process and go to "Threads" tab, you get a list of all thread and in "Start Address" you can see which DLL is each thread related to.

But in C# code the start address of each thread is just a pointer not a string. I wonder how "Process Explorer" does it? Any chance someone here could write a small C# sample code for me?

I would GREATLY appreciate it.