rabbitstack
diff --git a/‎pkg/alertsender/renderer/renderer_test.go
Copy file name to clipboard
+4-4Lines changed: 4 additions & 4 deletions b/‎pkg/alertsender/renderer/renderer_test.go
Copy file name to clipboard
+4-4Lines changed: 4 additions & 4 deletions
diff --git a/‎pkg/filter/accessor_windows.go
Copy file name to clipboard
+2-2Lines changed: 2 additions & 2 deletions b/‎pkg/filter/accessor_windows.go
Copy file name to clipboard
+2-2Lines changed: 2 additions & 2 deletions
diff --git a/‎pkg/filter/fields/fields_windows.go
Copy file name to clipboard
+4-1Lines changed: 4 additions & 1 deletion b/‎pkg/filter/fields/fields_windows.go
Copy file name to clipboard
+4-1Lines changed: 4 additions & 1 deletion
diff --git a/‎pkg/filter/filter_test.go
Copy file name to clipboard
+11-10Lines changed: 11 additions & 10 deletions b/‎pkg/filter/filter_test.go
Copy file name to clipboard
+11-10Lines changed: 11 additions & 10 deletions
diff --git a/‎pkg/kevent/batch_test.go
Copy file name to clipboard
+6-6Lines changed: 6 additions & 6 deletions b/‎pkg/kevent/batch_test.go
Copy file name to clipboard
+6-6Lines changed: 6 additions & 6 deletions
diff --git a/‎pkg/kevent/kevent_windows.go
Copy file name to clipboard
+2-2Lines changed: 2 additions & 2 deletions b/‎pkg/kevent/kevent_windows.go
Copy file name to clipboard
+2-2Lines changed: 2 additions & 2 deletions
diff --git a/‎pkg/kevent/kparam_windows.go
Copy file name to clipboard
+3-3Lines changed: 3 additions & 3 deletions b/‎pkg/kevent/kparam_windows.go
Copy file name to clipboard
+3-3Lines changed: 3 additions & 3 deletions
diff --git a/‎pkg/kevent/kparams/fields_windows.go
Copy file name to clipboard
+2-2Lines changed: 2 additions & 2 deletions b/‎pkg/kevent/kparams/fields_windows.go
Copy file name to clipboard
+2-2Lines changed: 2 additions & 2 deletions
diff --git a/‎pkg/kevent/marshaller_test.go
Copy file name to clipboard
+6-6Lines changed: 6 additions & 6 deletions b/‎pkg/kevent/marshaller_test.go
Copy file name to clipboard
+6-6Lines changed: 6 additions & 6 deletions
diff --git a/‎pkg/kevent/marshaller_windows.go
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/‎pkg/kevent/marshaller_windows.go
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
@@ -91,8 +91,8 @@ func TestHTMLFormatterRuleAlert(t *testing.T) {
 					SessionID: 4,
 					Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit", "Path": "C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Git\\cmd;C:\\msys64\\mingw64\\bin;C:\\WINDOWS\\System32\\OpenSSH\\;C:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\;C:\\Program Files\\nodejs\\;C:\\rubyinstaller-2.5.7-1-x64\\bin;C:\\Program Files (x86)\\WiX Toolset v3.11\\bin;C:\\Program Files (x86)\\Windows Kits\\10\\App Certification Kit;C:\\Program Files (x86)\\Graphviz2.38\\bin;C:\\Program Files (x86)\\NSIS\\Bin;C:\\Program Files\\Jdk11\\bin;C:\\Python310;C:\\msys64\\usr\\bin;C:\\Program Files\\dotnet\\;C:\\Program Files\\Go\\bin;C:\\Program Files\\Fibratus\\Bin;C:\\Program Files\\AutoFirma\\AutoFirma;C:\\Users\\nedo\\AppData\\Local\\Programs\\Python\\Launcher\\;C:\\Scripts\\;C:\\;C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\bin;C:\\Users\\nedo\\AppData\\Local\\Microsoft\\WindowsApps;C:\\Users\\nedo\\AppData\\Roaming\\npm;C:\\Users\\nedo\\AppData\\Local\\Programs\\oh-my-posh\\bin;C:\\Users\\nedo\\go\\bin"},
 					Threads: map[uint32]pstypes.Thread{
-						3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-						3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+						3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+						3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 					},
 					Modules: []pstypes.Module{
 						{Name: "C:\\Windows\\System32\\kernel32.dll", Size: 1233405456},
@@ -185,8 +185,8 @@ func TestHTMLFormatterRuleAlert(t *testing.T) {
 					SessionID: 4,
 					Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
 					Threads: map[uint32]pstypes.Thread{
-						3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-						3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+						3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+						3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 					},
 					Modules: []pstypes.Module{
 						{Name: "C:\\Windows\\System32\\kernel32.dll", Size: 1233405456},
 
@@ -559,8 +559,8 @@ func (t *threadAccessor) Get(f fields.Field, kevt *kevent.Kevent) (kparams.Value
 		return kevt.GetParamAsString(kparams.UstackBase), nil
 	case fields.ThreadUstackLimit:
 		return kevt.GetParamAsString(kparams.UstackLimit), nil
-	case fields.ThreadEntrypoint:
-		return kevt.GetParamAsString(kparams.StartAddr), nil
+	case fields.ThreadEntrypoint, fields.ThreadStartAddress:
+		return kevt.GetParamAsString(kparams.StartAddress), nil
 	case fields.ThreadPID:
 		return kevt.Kparams.GetUint32(kparams.ProcessID)
 	case fields.ThreadAccessMask:
 
@@ -169,6 +169,8 @@ const (
 	ThreadUstackLimit Field = "thread.ustack.limit"
 	// ThreadEntrypoint is the thread entrypoint address
 	ThreadEntrypoint Field = "thread.entrypoint"
+	// ThreadStartAddress is the thread start address
+	ThreadStartAddress Field = "thread.start_address"
 	// ThreadPID is the process identifier where the thread is created
 	ThreadPID Field = "thread.pid"
 	// ThreadAccessMask represents the thread access rights field
@@ -664,7 +666,8 @@ var fields = map[Field]FieldInfo{
 	ThreadKstackLimit:                       {ThreadKstackLimit, "limit of the thread's kernel space stack", kparams.Address, []string{"thread.kstack.limit = 'a85d800000'"}, nil},
 	ThreadUstackBase:                        {ThreadUstackBase, "base address of the thread's user space stack", kparams.Address, []string{"thread.ustack.base = '7ffe0000'"}, nil},
 	ThreadUstackLimit:                       {ThreadUstackLimit, "limit of the thread's user space stack", kparams.Address, []string{"thread.ustack.limit = '8ffe0000'"}, nil},
-	ThreadEntrypoint:                        {ThreadEntrypoint, "starting address of the function to be executed by the thread", kparams.Address, []string{"thread.entrypoint = '7efe0000'"}, nil},
+	ThreadEntrypoint:                        {ThreadEntrypoint, "starting address of the function to be executed by the thread", kparams.Address, []string{"thread.entrypoint = '7efe0000'"}, &Deprecation{Since: "2.3.0", Fields: []Field{ThreadStartAddress}}},
+	ThreadStartAddress:                      {ThreadStartAddress, "thread start address", kparams.Address, []string{"thread.start_address = '7efe0000'"}, nil},
 	ThreadPID:                               {ThreadPID, "the process identifier where the thread is created", kparams.Uint32, []string{"kevt.pid != thread.pid"}, nil},
 	ThreadAccessMask:                        {ThreadAccessMask, "thread desired access rights", kparams.AnsiString, []string{"thread.access.mask = '0x1fffff'"}, nil},
 	ThreadAccessMaskNames:                   {ThreadAccessMaskNames, "thread desired access rights as a string list", kparams.Slice, []string{"thread.access.mask.names in ('IMPERSONATE')"}, nil},
 
@@ -269,16 +269,16 @@ func TestProcFilter(t *testing.T) {
 
 func TestThreadFilter(t *testing.T) {
 	kpars := kevent.Kparams{
-		kparams.ProcessID:   {Name: kparams.ProcessID, Type: kparams.PID, Value: uint32(os.Getpid())},
-		kparams.ThreadID:    {Name: kparams.ThreadID, Type: kparams.TID, Value: uint32(3453)},
-		kparams.BasePrio:    {Name: kparams.BasePrio, Type: kparams.Uint8, Value: uint8(13)},
-		kparams.StartAddr:   {Name: kparams.StartAddr, Type: kparams.Address, Value: uint64(140729524944768)},
-		kparams.IOPrio:      {Name: kparams.IOPrio, Type: kparams.Uint8, Value: uint8(2)},
-		kparams.KstackBase:  {Name: kparams.KstackBase, Type: kparams.Address, Value: uint64(18446677035730165760)},
-		kparams.KstackLimit: {Name: kparams.KstackLimit, Type: kparams.Address, Value: uint64(18446677035730137088)},
-		kparams.PagePrio:    {Name: kparams.PagePrio, Type: kparams.Uint8, Value: uint8(5)},
-		kparams.UstackBase:  {Name: kparams.UstackBase, Type: kparams.Address, Value: uint64(86376448)},
-		kparams.UstackLimit: {Name: kparams.UstackLimit, Type: kparams.Address, Value: uint64(86372352)},
+		kparams.ProcessID:    {Name: kparams.ProcessID, Type: kparams.PID, Value: uint32(os.Getpid())},
+		kparams.ThreadID:     {Name: kparams.ThreadID, Type: kparams.TID, Value: uint32(3453)},
+		kparams.BasePrio:     {Name: kparams.BasePrio, Type: kparams.Uint8, Value: uint8(13)},
+		kparams.StartAddress: {Name: kparams.StartAddress, Type: kparams.Address, Value: uint64(140729524944768)},
+		kparams.IOPrio:       {Name: kparams.IOPrio, Type: kparams.Uint8, Value: uint8(2)},
+		kparams.KstackBase:   {Name: kparams.KstackBase, Type: kparams.Address, Value: uint64(18446677035730165760)},
+		kparams.KstackLimit:  {Name: kparams.KstackLimit, Type: kparams.Address, Value: uint64(18446677035730137088)},
+		kparams.PagePrio:     {Name: kparams.PagePrio, Type: kparams.Uint8, Value: uint8(5)},
+		kparams.UstackBase:   {Name: kparams.UstackBase, Type: kparams.Address, Value: uint64(86376448)},
+		kparams.UstackLimit:  {Name: kparams.UstackLimit, Type: kparams.Address, Value: uint64(86372352)},
 	}
 	kevt := &kevent.Kevent{
 		Type:     ktypes.CreateThread,
@@ -326,6 +326,7 @@ func TestThreadFilter(t *testing.T) {
 		{`thread.ustack.limit = '525f000'`, true},
 		{`thread.kstack.base = 'ffffc307810d6000'`, true},
 		{`thread.kstack.limit = 'ffffc307810cf000'`, true},
+		{`thread.start_address = '7ffe2557ff80'`, true},
 		{`thread.callstack.summary = 'KERNELBASE.dll|KERNEL32.DLL|java.dll|unbacked'`, true},
 		{`thread.callstack.detail icontains 'C:\\WINDOWS\\System32\\KERNELBASE.dll!CreateProcessW+0x66'`, true},
 		{`thread.callstack.modules in ('C:\\WINDOWS\\System32\\KERNELBASE.dll', 'C:\\Program Files\\JetBrains\\GoLand 2021.2.3\\jbr\\bin\\java.dll')`, true},
 
@@ -65,8 +65,8 @@ func TestBatchMarshalJSON(t *testing.T) {
 			SessionID: 4,
 			Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
 			Threads: map[uint32]pstypes.Thread{
-				3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-				3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 			},
 			Handles: []htypes.Handle{
 				{Num: windows.Handle(0xffffd105e9baaf70),
@@ -133,8 +133,8 @@ func TestBatchMarshalJSON(t *testing.T) {
 			SessionID: 4,
 			Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
 			Threads: map[uint32]pstypes.Thread{
-				3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-				3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 			},
 			Handles: []htypes.Handle{
 				{Num: windows.Handle(0xffffd105e9baaf70),
@@ -201,8 +201,8 @@ func TestBatchMarshalJSON(t *testing.T) {
 			SessionID: 4,
 			Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
 			Threads: map[uint32]pstypes.Thread{
-				3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-				3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 			},
 			Handles: []htypes.Handle{
 				{Num: windows.Handle(0xffffd105e9baaf70),
 
@@ -430,12 +430,12 @@ func (e *Kevent) Summary() string {
 			exe, access))
 	case ktypes.CreateThread:
 		tid, _ := e.Kparams.GetTid()
-		addr := e.GetParamAsString(kparams.StartAddr)
+		addr := e.GetParamAsString(kparams.StartAddress)
 		return printSummary(e, fmt.Sprintf("spawned a new thread with <code>%d</code> id at <code>%s</code> address",
 			tid, addr))
 	case ktypes.TerminateThread:
 		tid, _ := e.Kparams.GetTid()
-		addr := e.GetParamAsString(kparams.StartAddr)
+		addr := e.GetParamAsString(kparams.StartAddress)
 		return printSummary(e, fmt.Sprintf("terminated a thread with <code>%d</code> id at <code>%s</code> address",
 			tid, addr))
 	case ktypes.OpenThread:
 
@@ -272,7 +272,7 @@ func (e *Kevent) produceParams(evt *etw.EventRecord) {
 			tid            uint32
 			kstack, klimit uint64
 			ustack, ulimit uint64
-			startAddr      uint64
+			startAddress   uint64
 			basePrio       uint8
 			pagePrio       uint8
 			ioPrio         uint8
@@ -289,7 +289,7 @@ func (e *Kevent) produceParams(evt *etw.EventRecord) {
 			klimit = evt.ReadUint64(16)
 			ustack = evt.ReadUint64(24)
 			ulimit = evt.ReadUint64(32)
-			startAddr = evt.ReadUint64(48)
+			startAddress = evt.ReadUint64(48)
 		}
 		if evt.Version() >= 3 {
 			basePrio = evt.ReadByte(69)
@@ -302,7 +302,7 @@ func (e *Kevent) produceParams(evt *etw.EventRecord) {
 		e.AppendParam(kparams.KstackLimit, kparams.Address, klimit)
 		e.AppendParam(kparams.UstackBase, kparams.Address, ustack)
 		e.AppendParam(kparams.UstackLimit, kparams.Address, ulimit)
-		e.AppendParam(kparams.StartAddr, kparams.Address, startAddr)
+		e.AppendParam(kparams.StartAddress, kparams.Address, startAddress)
 		e.AppendParam(kparams.BasePrio, kparams.Uint8, basePrio)
 		e.AppendParam(kparams.PagePrio, kparams.Uint8, pagePrio)
 		e.AppendParam(kparams.IOPrio, kparams.Uint8, ioPrio)
 
@@ -74,8 +74,8 @@ const (
 	UstackBase = "ustack"
 	// UstackLimit field is the end address of the user space stack.
 	UstackLimit = "ustack_limit"
-	// StartAddr field is the address of the thread main function.
-	StartAddr = "entrypoint"
+	// StartAddress field is the thread start address.
+	StartAddress = "start_address"
 
 	// FileObject determines the field name for the file object pointer.
 	FileObject = "file_object"
 
@@ -146,8 +146,8 @@ func TestKeventMarshalJSON(t *testing.T) {
 			SessionID: 4,
 			Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
 			Threads: map[uint32]pstypes.Thread{
-				3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-				3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 			},
 			Handles: []htypes.Handle{
 				{Num: windows.Handle(0xffffd105e9baaf70),
@@ -255,8 +255,8 @@ func TestUnmarshalHugeHandles(t *testing.T) {
 			SessionID: 4,
 			Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
 			Threads: map[uint32]pstypes.Thread{
-				3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-				3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+				3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 			},
 			Handles: handles,
 			PE: &pex.PE{
@@ -317,8 +317,8 @@ func TestKeventMarshalJSONMultiple(t *testing.T) {
 				SessionID: 4,
 				Envs:      map[string]string{"ProgramData": "C:\\ProgramData", "COMPUTRENAME": "archrabbit"},
 				Threads: map[uint32]pstypes.Thread{
-					3453: {Tid: 3453, Entrypoint: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
-					3455: {Tid: 3455, Entrypoint: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+					3453: {Tid: 3453, StartAddress: va.Address(140729524944768), IOPrio: 2, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
+					3455: {Tid: 3455, StartAddress: va.Address(140729524944768), IOPrio: 3, PagePrio: 5, KstackBase: va.Address(18446677035730165760), KstackLimit: va.Address(18446677035730137088), UstackLimit: va.Address(86376448), UstackBase: va.Address(86372352)},
 				},
 				Handles: []htypes.Handle{
 					{Num: windows.Handle(0xffffd105e9baaf70),
 
@@ -609,7 +609,7 @@ func (e *Kevent) MarshalJSON() []byte {
 				js.writeObjectField("ioprio").writeUint8(thread.IOPrio).writeMore()
 				js.writeObjectField("baseprio").writeUint8(thread.BasePrio).writeMore()
 				js.writeObjectField("pageprio").writeUint8(thread.PagePrio).writeMore()
-				js.writeObjectField("entrypoint").writeString(thread.Entrypoint.String()).writeMore()
+				js.writeObjectField("start_address").writeString(thread.StartAddress.String()).writeMore()
 				js.writeObjectField("ustack_base").writeString(thread.UstackBase.String()).writeMore()
 				js.writeObjectField("ustack_limit").writeString(thread.UstackLimit.String()).writeMore()
 				js.writeObjectField("kstack_base").writeString(thread.KstackBase.String()).writeMore()