Topic created on: February 19, 2009 08:02 CST by remc.
Hello,
I need to know the state(running, waiting) of a thread in the same process.
The state of a thread is kept in the member kthread.state, is it possible to read this value some how from user-mode?
The NtQuerySystemInformation function called with the SystemProcessInformation information class will give you a SYSTEM_PROCESS_INFORMATION array containing a list of processes and threads.
The Threads field of this array points to a further array of SYSTEM_THREAD structures describing the process's threads. The State field should describe what you're looking for.
According to MS, the SYSTEM_PROCESS_INFORMATION structure is not fully documented enough to be able to do this:
You need to allocate a large enough return buffer when working with any of the Nt/ZwQuerySystemInformation Classes since you're usually dealing with an array of unknown size. There are 3 strategies for this, and you might use a different one for each Class.
1. Allocate a large enough buffer to begin with.
2. Call NtQuerySystemInformation twice, the first time with a 0 buffer size. This will return STATUS_INFO_LENGTH_MISMATCH and give the required buffer size in ReturnLength. Then you allocate a buffer of the correct size and call the function again. This will work for the SystemModuleInformation Class.
3. If STATUS_INFO_LENGTH_MISMATCH is returned but ReturnLength *doesn't* return the required buffer length you can create a loop. Say, allocate 1 page size of memory, call NtQuerySystemInformation, free the memory, allocate a larger buffer and repeat until STATUS_INFO_LENGTH_MISMATCH is *not* returned. This might be required for the SystemProcessInformation Class.
I've parsed these structures with these definitions in kernel mode using ZwQuerySystemInformation, it should work from user mode as well.
Thanks Kayaker, I will give it a spin and see if it works. I looked at the structures before on Msdn, but that was kind of a show stopper since they are not fully documented.
rem-c
Note: Registration is required to post to the forums.