[Flopik]

On Windows 7 x64 Sp1, I have a thread :

lkd> dt _ETHREAD 0xfffffa8007b6a7b0
nt!_ETHREAD
+0x388 StartAddress : 0x00000000`7749c500 Void
+0x410 Win32StartAddress : 0x00000000`0a54b190 Void

0:044> ln 0x00000000`7749c500
(00000000`7749c500) ntdll!RtlUserThreadStart | (00000000`7749c530) ntdll!LdrpInitializeThread
Exact matches:
ntdll!RtlUserThreadStart = <no type information>

0:044> ln 0x00000000`7749c500
(00000000`7749c500) ntdll!RtlUserThreadStart | (00000000`7749c530) ntdll!LdrpInitializeThread
Exact matches:
ntdll!RtlUserThreadStart = <no type information>
0:044> !address 0x00000000`0a54b190
Usage: <unclassified>
Allocation Base: 00000000`0a4a0000
Base Address: 00000000`0a4a1000
End Address: 00000000`0a585000
Region Size: 00000000`000e4000
Type: 00020000 MEM_PRIVATE
State: 00001000 MEM_COMMIT
Protect: 00000020 PAGE_EXECUTE_READ


Why Win32StartAddress is set to a non module address? I wanna validate if their a rogue thread in this process. How to choice between the 2?

[Alex]

This is a quota of Nebbett's book (Windows NT/2000 Native API):

PVOID Win32StartAddress; // Information Class 9

This information class can be both queried and set.
For the Intel platform, the initial value of this variable is the value of the Eax register
in the Context structure passed to ZwCreateThread. If the thread is started using the
thread start thunk in kernel32.dll, Eax contains the “Win32 start address.”
The field in the ETHREAD structure that is queried and set by this information class is
also used to hold the “LpcReceivedMessageId.”Any thread that has called
ZwReplyWaitReplyPort or ZwReplyWaitReceivePort will have modified this field.
In David Solomon’s Inside Windows NT (second edition, Microsoft Press, 1998) the
output of the resource kit utility “tlist” is included to illustrate the difference
between the actual start address and the Win32 start address; one of the Win32 start
addresses in the tlist output is less than 0x10000 (normally a reserved region of the
address space)—this thread is called ZwReplyWaitReceivePort.