HANDLE hProcess = GetCurrentProcess();
SymInitialize(hProcess, NULL, TRUE);
 
/* En C llamariamos a CreateToolhelp32Snapshot() y Module32First()/Module32Next() para obtener los modulos cargados.
En .NET creo que los obtienes directamente en Process.Modules */
For cada Modulo en proceso.Modules
	SymLoadModule64(hProcess, NULL, Modulo.FileName, Modulo.ModuleName, Modulo.BaseAddress, Modulo.ModuleMemorySize);
Next Modulo

/* En C, Thread32First()/Thread32Next(). En .NET, en la coleccion Threads */
IMAGEHLP_SYMBOL64 *pSym = NULL;
For cada thread en proceso.ProcessThreads
 

	HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, false, thread.id);
	CONTEXT context;
	context.ContextFlags = CONTEXT_FULL;
 
	// Comparar el id, NO el handle
	if (thread.id == System.Threading.Thread.CurrentThread.ManagedThreadId)
              RtlCaptureContext(&context);
	else {
              SuspendThread(hThread);
              GetThreadContext(hThread, &context);
              ResumeThread(hThread);
	}

       size_t startAddress;
 
       NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &startAddress, sizeof(startAddress), NULL);

       STACKFRAME64 sf64;
       sf64.AddrPC.Offset = context.Eip;
       sf64.AddrPC.Mode = AddrModeFlat;
       sf64.AddrFrame.Offset = context.Ebp;
       sf64.AddrFrame.Mode = AddrModeFlat;
       sf64.AddrStack.Offset = context.Esp;
       sf64.AddrStack.Mode = AddrModeFlat;
 
       StackWalk64(IMAGE_FILE_MACHINE_I386, hProcess, hThread, &sf64, &context, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL);

       IMAGEHLP_MODULE64 module;
       memset(&module, 0, sizeof(module));
       module.SizeOfStruct = sizeof(module);
       SymGetModuleInfo64(hProcess, sf64.AddrPC.Offset, &module);
 

       IMAGEHLP_MODULE64 module;
       memset(&module, 0, sizeof(module));
       module.SizeOfStruct = sizeof(module);
       SymGetModuleInfo64(hProcess, startAddress, &module);
 

       if (!pSym) (IMAGEHLP_SYMBOL64*)malloc(sizeof(IMAGEHLP_SYMBOL64) + MAX_SYM_NAME * sizeof(TCHAR));
 
       memset(pSym, 0, sizeof(IMAGEHLP_SYMBOL64) + MAX_SYM_NAME);
       pSym->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL64);
       pSym->MaxNameLength = MAX_SYM_NAME;
 
       SymGetSymFromAddr64(hProcess, startAddress, NULL, pSym);

	Console.WriteLine(module.ModuleName & "!" & pSym.Name & "+" (startAddress - pSym.Address).ToString("x"))
	CloseHandle(hThread);
Next thread
free(pSym);
 

miEjecutable!mainCRTStartup+0
ntdll!TpCallbackIndependent+140

[DllImport("ntdll.dll", CharSet = CharSet.Unicode, SetLastError = true)]
static extern int NtQueryInformationThread(IntPtr ThreadHandle, ThreadInfoClass ThreadInformationClass, IntPtr ThreadInformation, int ThreadInformationLength, IntPtr ReturnLength);

IntPtr hThread = OpenThread(0x0040, false, idHilo);

IntPtr startAddress = Marshal.AllocHGlobal(IntPtr.Size);
NtQueryInformationThread(hThread, 9, startAddress, IntPtr.Size, IntPtr.Zero);

CloseHandle(hThread);

  if(write(fd, &userid, sizeof(int)) == -1 )

  databuffer = (char *) ec_malloc(sizeof(argv[1]));