Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


map from thread id to ethread pointer

In kernel space, how does one map from a thread id to an ethread pointer?

In a kernel driver, I have set up a routine to get a callback on thread
creation using PsSetCreateThreadNotifyRoutine(). When my routine is
invoked, it is called with ProcessId & ThreadId (and a boolean create,
which is true on creation & false on termination). I would like to
get access at that point to the ethread associated with the thread
id argument. Softice knows how to do this, in the sense that the output
from the "thread" command in softice includes this newbie ThreadId with
its correspoinding ethead (kteb).

I can easily get the thread id & ethread associated with a currently
running thread, using PsGetCurrentThreadId() & PsGetCurrentThread(),
but the ThreadId with which the callback routine is called at creation
time is never the currently active thread (which makes sense to me,
system hasn't cranked up this new thread yet).

Thanks in advance! I'm totally stumped, anne

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hello,

    You can use ZwOpenThread/NtOpenThread function to get
    handle to the thread using thread id. Then, you can
    use ObReferenceObjectByHandle function to reach to the
    KTEB.

    -Prasad

    --- [email protected] wrote:
    > In kernel space, how does one map from a thread id
    > to an ethread pointer?
    >
    > In a kernel driver, I have set up a routine to get a
    > callback on thread
    > creation using PsSetCreateThreadNotifyRoutine().
    > When my routine is
    > invoked, it is called with ProcessId & ThreadId (and
    > a boolean create,
    > which is true on creation & false on termination).
    > I would like to
    > get access at that point to the ethread associated
    > with the thread
    > id argument. Softice knows how to do this, in the
    > sense that the output
    > from the "thread" command in softice includes this
    > newbie ThreadId with
    > its correspoinding ethead (kteb).
    >
    > I can easily get the thread id & ethread associated
    > with a currently
    > running thread, using PsGetCurrentThreadId() &
    > PsGetCurrentThread(),
    > but the ThreadId with which the callback routine is
    > called at creation
    > time is never the currently active thread (which
    > makes sense to me,
    > system hasn't cranked up this new thread yet).
    >
    > Thanks in advance! I'm totally stumped, anne
    >
    > ---
    > You are currently subscribed to ntdev as:
    > [email protected]
    > To unsubscribe send a blank email to
    > $subst('Email.Unsub')
    >


    =====
    Prasad S. Dabak
    Director of Engineering, Windows NT/2000 Division
    Cybermedia Software Private Limited
    http://www.cybermedia.co.in
    Co-author of the book "Undocumented Windows NT"
    ISBN 0764545698

    __________________________________________________
    Do You Yahoo!?
    Kick off your party with Yahoo! Invites.
    http://invites.yahoo.com/
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    You can use following three routines:

    NTKERNELAPI
    NTSTATUS
    PsLookupProcessByProcessId (
    IN HANDLE ProcessId,
    OUT PEPROCESS *Process
    );

    NTKERNELAPI
    NTSTATUS
    PsLookupThreadByThreadId (
    IN HANDLE ThreadId,
    OUT PETHREAD *Thread
    );

    NTKERNELAPI
    NTSTATUS
    PsLookupProcessThreadByCid (
    IN PCLIENT_ID ClientId,
    OUT PEPROCESS *Process OPTIONAL,
    OUT PETHREAD *Thread
    );

    But there are some headaches.
    I will send you some sample code if you want.

    Paul

    > -----P?vodn? zpr?va-----
    > Od: Prasad Dabak [SMTP:[email protected]]
    > Odesl?no: 1. ?ervence 2000 21:33
    > Komu: NT Developers Interest List
    > P?edm?t: [ntdev] Re: map from thread id to ethread pointer
    >
    > Hello,
    >
    > You can use ZwOpenThread/NtOpenThread function to get
    > handle to the thread using thread id. Then, you can
    > use ObReferenceObjectByHandle function to reach to the
    > KTEB.
    >
    > -Prasad
    >
    > --- [email protected] wrote:
    > > In kernel space, how does one map from a thread id
    > > to an ethread pointer?
    > >
    > > In a kernel driver, I have set up a routine to get a
    > > callback on thread
    > > creation using PsSetCreateThreadNotifyRoutine().
    > > When my routine is
    > > invoked, it is called with ProcessId & ThreadId (and
    > > a boolean create,
    > > which is true on creation & false on termination).
    > > I would like to
    > > get access at that point to the ethread associated
    > > with the thread
    > > id argument. Softice knows how to do this, in the
    > > sense that the output
    > > from the "thread" command in softice includes this
    > > newbie ThreadId with
    > > its correspoinding ethead (kteb).
    > >
    > > I can easily get the thread id & ethread associated
    > > with a currently
    > > running thread, using PsGetCurrentThreadId() &
    > > PsGetCurrentThread(),
    > > but the ThreadId with which the callback routine is
    > > called at creation
    > > time is never the currently active thread (which
    > > makes sense to me,
    > > system hasn't cranked up this new thread yet).
    > >
    > > Thanks in advance! I'm totally stumped, anne
    > >
    > > ---
    > > You are currently subscribed to ntdev as:
    > > [email protected]
    > > To unsubscribe send a blank email to
    > > $subst('Email.Unsub')
    > >
    >
    >
    > =====
    > Prasad S. Dabak
    > Director of Engineering, Windows NT/2000 Division
    > Cybermedia Software Private Limited
    > http://www.cybermedia.co.in
    > Co-author of the book "Undocumented Windows NT"
    > ISBN 0764545698
    >
    > __________________________________________________
    > Do You Yahoo!?
    > Kick off your party with Yahoo! Invites.
    > http://invites.yahoo.com/
    >
    > ---
    > You are currently subscribed to ntdev as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online