Get Threads Start Address with Powershell

Question

I have task, need to get Thread Start Address from selected process or selected Thread.

$result = Get-Process -Name notepad -IncludeUserName

$Threads =@()
    foreach ($ID in $result)
     {
        $Threads += Get-Process -ID $ID.ID | Select-Object -ExpandProperty  Threads | Select-Object ID
     }

I can get data like this

but start address thread don't get information like on Process Explorer.

I find some example with C# Low-Level Windows API Access, like i see this solution, but i need help to adopt the script Kernel32 : : CreateProcess to get PROCESS_INFORMATION on C++ and finally get Start Address of Threads.

Can anyone help me ?

I don't think that this task can be solved only by means of Powershell, so I look wider and see the solution in running C # or C ++ code inside powershell script.

user_13702221 · Answer

You have to drill down a bit further:

PS> $x = Get-Process

PS> $x[0].mainmodule

   Size(K) ModuleName                                         FileName                                                            
   ------- ----------                                         --------                                                            
      2168 chrome.exe                                         C:\Program Files (x86)\Google\Chrome\Application\chrome.exe         



PS> $x[0].mainmodule | gm


   TypeName: System.Diagnostics.ProcessModule

Name                      MemberType     Definition                                                              
----                      ----------     ----------                                                              
Disposed                  Event          System.EventHandler Disposed(System.Object, System.EventArgs)           
CreateObjRef              Method         System.Runtime.Remoting.ObjRef CreateObjRef(type requestedType)         
Dispose                   Method         void Dispose(), void IDisposable.Dispose()                              
Equals                    Method         bool Equals(System.Object obj)                                          
GetHashCode               Method         int GetHashCode()                                                       
GetLifetimeService        Method         System.Object GetLifetimeService()                                      
GetType                   Method         type GetType()                                                          
InitializeLifetimeService Method         System.Object InitializeLifetimeService()                               
ToString                  Method         string ToString()                                                       
BaseAddress               Property       System.IntPtr BaseAddress {get;}                                        
Container                 Property       System.ComponentModel.IContainer Container {get;}                       
EntryPointAddress         Property       System.IntPtr EntryPointAddress {get;}                                  
FileName                  Property       string FileName {get;}                                                  
FileVersionInfo           Property       System.Diagnostics.FileVersionInfo FileVersionInfo {get;}               
ModuleMemorySize          Property       int ModuleMemorySize {get;}                                             
ModuleName                Property       string ModuleName {get;}                                                
Site                      Property       System.ComponentModel.ISite Site {get;set;}                             
Company                   ScriptProperty System.Object Company {get=$this.FileVersionInfo.CompanyName;}          
Description               ScriptProperty System.Object Description {get=$this.FileVersionInfo.FileDescription;}  
FileVersion               ScriptProperty System.Object FileVersion {get=$this.FileVersionInfo.FileVersion;}      
Product                   ScriptProperty System.Object Product {get=$this.FileVersionInfo.ProductName;}          
ProductVersion            ScriptProperty System.Object ProductVersion {get=$this.FileVersionInfo.ProductVersion;}
Size                      ScriptProperty System.Object Size {get=$this.ModuleMemorySize / 1024;}                 

PS> $x[0].mainmodule.BaseAddress
140699046510592

I think BaseAddress is the property you want.

Get Threads Start Address with Powershell

1 Answers