I haven't particularly had to do this before, but each Process object also has a collection of ProcessModule objects associated with it; the modules are the files (dll, exe). Each ProcessModule has a BaseAddress and ModuleMemorySize property, and the ProcessThread object also has a StartAddress property, so it seems like its something you can calculate, and figure out which thread is associated with which module.



Pointer addresses can be converted to integers.

Does that help?