Windows handle information

some posts on this topic:
http://forum.sysinternals.com/forum_posts.asp?TID=3577&PN=2
http://forum.sysinternals.com/forum_posts.asp?TID=1193&PN=1

Windows thread information

NtQuerySystemInformation (SystemProcessesAndThreadsInformation...) works, GetThreadStartAddress working not as expected/named. NtQueryInformationThread is too. As the bottom of the stack in pre-Vista systems is kernel32!BaseProcessStart or kernel32!BaseThreadStart, one can usually look up one frame in the stack to find the module containing the "ThreadProc".