hi,
I have Question regarding Threads, How can I Get parent thread ID of a thread. I want to list descendant threads of a thread that has been created by some other process. I have parent thread Id but not able to map child -parent relation ship between the threads.
Any help really appreciated.
Thanks,
Sachin
Can Ps notify callback provide this info?
–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com
wrote in message news:xxxxx@ntdev…
> hi,
>
> I have Question regarding Threads, How can I Get parent thread ID of a thread. I want to list descendant threads of a thread that has been created by some other process. I have parent thread Id but not able to map child -parent relation ship between the threads.
>
> Any help really appreciated.
>
> Thanks,
> Sachin
>
>
My first question is why do you want this? Windows does not have any thread
hierarchy like some systems, and does not even provide this data in the
native API calls. Once a thread is created in Windows the parent is
irrelevant.
Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Wednesday, February 17, 2016 9:21 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Get parent thread ID of a thread
hi,
I have Question regarding Threads, How can I Get parent thread ID of a
thread. I want to list descendant threads of a thread that has been created
by some other process. I have parent thread Id but not able to map child
-parent relation ship between the threads.
Any help really appreciated.
Thanks,
Sachin
NTDEV is sponsored by OSR
Visit the list online at:
http:
MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:
To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:>
In Windows, Only Parent can keep track of child threads/processes in
explicit way,
Even though you find from child to parent, it will not be correct
always.(because you might ask why internal structures have data…)
Like what Don says:
>Once a thread is created in Windows the parent is irrelevant.<<
Regards,
AVKGuru
On Wed, Feb 17, 2016 at 10:02 PM, Don Burn wrote:
> My first question is why do you want this? Windows does not have any
> thread
> hierarchy like some systems, and does not even provide this data in the
> native API calls. Once a thread is created in Windows the parent is
> irrelevant.
>
>
> Don Burn
> Windows Driver Consulting
> Website: http://www.windrvr.com
>
>
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@gmail.com
> Sent: Wednesday, February 17, 2016 9:21 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Get parent thread ID of a thread
>
> hi,
>
> I have Question regarding Threads, How can I Get parent thread ID of a
> thread. I want to list descendant threads of a thread that has been created
> by some other process. I have parent thread Id but not able to map child
> -parent relation ship between the threads.
>
> Any help really appreciated.
>
> Thanks,
> Sachin
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at:
> http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software
> drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
>
–
кумарагуру</http:></http:></http:></http:>
Thanks all for your help,
Answering to Don Burn’s question, actually I want monitor a thread behavior for some time and if it found suspicious then attempting to stop the thread as well as descendant threads.
Maxim, I will look into PsSetCreateThreadNotifyRoutine
Thanks,
Sachin
> Answering to Don Burn’s question, actually I want monitor a thread behavior for some time and if it
found suspicious then attempting to stop the thread as well as descendant threads.
Stopping the thread will, nearly for sure, totally hang the logic of the process to which it belongs.
Absolutely evil idea. Just kill the process instead.
–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com
> Answering to Don Burn’s question, actually I want monitor a thread behavior for some time
and if it found suspicious then attempting to stop the thread as well as descendant threads.
Something tells me Mr.Burn is going to react to the aove statement more or less the following way:
THIS IS NO BETTER THAN A VIRUS OR OTHER MALWARE.
My recommendation is:
a. Publish the name of the program and the organization requiring you do this crap, so we can all avoid it.
b. Publish your name and who you work for so we can avoid anything to do with either.
c. Quit this nonsense and get a job in another field, you obviously aren’t going to make as a developer.
Search the archives for more info.Enjoy!!!
Anton Bassov
Anton,
Your assumptions continue to amaze me, somehow your belief you know what
I think shows me how stupid you are. I think Max pointed out the right
solution for the OP.
Don
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Thursday, February 18, 2016 5:30 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Get parent thread ID of a thread
Answering to Don Burn’s question, actually I want monitor a thread
behavior for some time and if it found suspicious then attempting to stop
the thread as well as descendant threads.
Something tells me Mr.Burn is going to react to the aove statement more or
less the following way:
THIS IS NO BETTER THAN A VIRUS OR OTHER MALWARE.
My recommendation is:
a. Publish the name of the program and the organization requiring you do
this crap, so we can all avoid it.
b. Publish your name and who you work for so we can avoid anything to do
with either.
c. Quit this nonsense and get a job in another field, you obviously aren’t
going to make as a developer.
Search the archives for more info.Enjoy!!!
Anton Bassov
NTDEV is sponsored by OSR
Visit the list online at:
http:
MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:
To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:>
> Your assumptions continue to amaze me, somehow your belief you know what I think…
Well, I did not make any “assumptions” here, did I - after all, in order to be able to assume what another person thinks one needs some extra-sensory/psychic/telepathic/etc powers that I obviously haven’t got. However, please note that, given a sufficient amount of statistical data one may still try to make a forecast with a certain degree of confidence (I would suggest picking any textbook on statistics if you need more info ). Once NTDEV archives provide vast amounts of data on the topic in question I tried to make a forecast with a certain degree of confidence (I would say,around 85 -90%.) However, I did not present it as an assumption, did I - instead, I prsented it as an “educated guess”, i.e. indirectly in “something tells me” form…
…shows me how stupid you are.
OK, let’s proceed to namecalling - would not it be a great fun to feel like 5-year-old kids…
In any case, the irony here is that your statements that I have quoted seem (at least to me) to be perfectly reasonable in this context - although the way they have been presented is, probably, a bit to the extreme, I DO agree with he general idea. More on it below.
I think Max pointed out the right solution for the OP.
The"only" thing left is to point out the right solution to the developers of some production application
(like, for example SQL Server or Oracle DB) in case the OP’s “masterpiece” deems its behavior
“suspicious” so that it decides to crash it…
Anton Bassov
What the OP is trying to do is to solve a halting theorem. This is what one needs to decide if a thread is “suspicious”.
Mr Burn: You know better than to feed the troll.
Anton: You disappoint me. Using the same trolling material multiple times is really beneath you. When you troll, the least you owe us is to come up with something new and interesting. Make it about physics, or a topic you are personally and deeply familiar with like hamsters and duct tape, for instance. Or at least insult my dog, for goodness sakes. But trotting out the same quotes time after time until you get a reaction from the author? Kinda lame.
Peter
OSR
@OSRDrivers
> Anton: You disappoint me. Using the same trolling material multiple times is really beneath you.
What makes you believe I am trolling??? However, I DO see your point - indeed, by quoting the same statement multiple times I may make one believe that I am quoting something exceptional, rather than providing just a typical example of Mr.Burn’s posting style. Therefore, I promise to search the archives for something new every time I quote Mr.Burn’s statements - as you know it yourelf, they are the full of statements like the ones I quoted( BTW, the first quotatation is new anyway - I haven’t used it before)…
When you troll, the least you owe us is to come up with something new and interesting.
Make it about physic
Well, you cannot make it happen upon the request,can you - everything depends on how the things go. For example, as recently as 5 days ago I provided a link to a comedy sketch that resulted in a heated discussion of advanced math (mainly concerning geometry). However, concerning the physics part, it hardly moved beyound the basics of Newtonian mechanics, although some attempts to discuss more advanced concepts like the phase space were made.Knowing about your keen interest in psychopharmacology I tried to divert the discussion to this topic, but had no success. Therefore, you never know how it all goes - if you are interested in physics I am afraid the only thing left is to wait patiently…
or a topic you are personally and deeply familiar with like hamsters and duct tape,
Having been surprised by such a weird combination and suspecting something idiomatical, I decided to Google a bit. However, I was a way too optomistic - the very first thing that I got is the following link
http://jokes-daily.blogspot.lu/2008/08/why-do-you-wrap-duct-tape-around.html
To be honest, I just could not suspect that your sense of humour might be THAT childish, Peter - assuming that we speak about the adults, this part seems (at least to me) a bit too silly even by the standards of career military officers (i.e the ones who tend to interpret the word “assume” in “rather peculliar” way). Now I see that, up to this point, I was, apparently, of too high opinion of your overall intelligence…
Or at least insult my dog, for goodness sakes.
Interesting suggestion …
I am highly impressed by the prospect of finding myself on the gallows alongside"Chutiya the Warrior" and “YahoooMan” for insulting “The Hanging Judge’s” dog…
But trotting out the same quotes time after time
Sorry, but this is not my fault that NTDEV became so boring and predictable these days that exactly the same Mr.Burn’s quotation applies again and again and again, alongside the mantras (not necessarily only Mr.Burn’s ones) about KMDF, inverted calls, the dangers of shared memory et al…
Anton Bassov
Peter Viscarola (OSR) wrote:
Or at least insult my dog, for goodness sakes.
Peter what kind of dog do you have?
Anton: Apply yourself a bit, man! You’re still failing badly in the interesting post" category. I mean… That’s as good as you can muster? Quality control, man, for heavens sake!
what kind of dog do you have
Purely in the interest of helping Anton be more creative: A German Shepherd and a Bernese Mountain Dog.
Peter
OSR
@OSRDrivers
On Fri, Feb 19, 2016 at 9:18 AM, wrote:
> > Or at least insult my dog, for goodness sakes.
>
> Peter what kind of dog do you have?
If I remember correctly it was a “Bad Dog!”.
Mark Roddy
Bernese Mountain Dog, a. k. a. The Official Dog of OSR.
mm
On Feb 19, 2016 10:36 AM, wrote:
> Anton: Apply yourself a bit, man! You’re still failing badly in the
> interesting post" category. I mean… That’s as good as you can muster?
> Quality control, man, for heavens sake!
>
> > what kind of dog do you have
>
> Purely in the interest of helping Anton be more creative: A German
> Shepherd and a Bernese Mountain Dog.
>
> Peter
> OSR
> @OSRDrivers
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
></http:>
> Purely in the interest of helping Anton be more creative: A German Shepherd and a Bernese >Mountain Dog.
Well, I don’t really know what either of them had done to you and why you are so desperate for these lovely creatures to be insulted, but, assuming that you really want to spread some nasty libel about either of them, I would highly recommend contacting Mr.Burn…
He will tell us about 100k+ ticks, fleas and other parasites (with at least half of them carrying life-threatening diseases like typhus,meningitis and encephalitis) that he had supposedly discovered on it; about its supposed attacks on people and other dogs(cats/birds/rats/pigs/enter a pet of your choice here) that resulted in multimillion lawsuits against its owners; about the supposed multimillion property damages caused by its urination and defecation in places that are inappropriate for these purposes; brand it a thief and accuse it of stealing food from the kitchen, as well as from other dogs(cats/birds/rats/pigs/cockroaches/spiders/fish/snakes/enter a pet of your choice here);etc,etc,etc.
All you have to do is to tell him that this dog belongs to
Mr.Torvalds/Mr.Stallman/Mr.Brin/Mr.Cook/Mr.Ellison/(enter any other leader of a company or of an open-source project of your choice ), and, as long as this company or an open-source project competes with MSFT’s products, it should do the trick just fine. However, if you tell him the dog in question is yours he will claim this is the best dog that has lived anywhere in the observable universe since the Big Bang. If I point out that, in actuality, he speaks about exactly the same dog he will claim this “magic transformation” of the dog is due to the change of its owner. If I dismiss this claim as a ridicuclous one he will accuse me of trolling and send you an off-list complaint
about me so that you turn up with a whip (or, probably, even with a noose). Nothing particularly new here, don’t you think…
Anton Bassov
Actually, the OSR Bernese Mountain Dog is extremely friendly. Dogs rarely
give you ticks and parasites, trolls on the other hand do…
Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Friday, February 19, 2016 6:14 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Get parent thread ID of a thread
Purely in the interest of helping Anton be more creative: A German
Shepherd and a Bernese >Mountain Dog.
Well, I don’t really know what either of them had done to you and why you
are so desperate for these lovely creatures to be insulted, but, assuming
that you really want to spread some nasty libel about either of them, I
would highly recommend contacting Mr.Burn…
He will tell us about 100k+ ticks, fleas and other parasites (with at least
half of them carrying life-threatening diseases like typhus,meningitis and
encephalitis) that he had supposedly discovered on it; about its supposed
attacks on people and other dogs(cats/birds/rats/pigs/enter a pet of your
choice here) that resulted in multimillion lawsuits against its owners;
about the supposed multimillion property damages caused by its urination
and defecation in places that are inappropriate for these purposes; brand it
a thief and accuse it of stealing food from the kitchen, as well as from
other dogs(cats/birds/rats/pigs/cockroaches/spiders/fish/snakes/enter a pet
of your choice here);etc,etc,etc.
All you have to do is to tell him that this dog belongs to
Mr.Torvalds/Mr.Stallman/Mr.Brin/Mr.Cook/Mr.Ellison/(enter any other leader
of a company or of an open-source project of your choice ), and, as long as
this company or an open-source project competes with MSFT’s products, it
should do the trick just fine. However, if you tell him the dog in question
is yours he will claim this is the best dog that has lived anywhere in the
observable universe since the Big Bang. If I point out that, in actuality,
he speaks about exactly the same dog he will claim this “magic
transformation” of the dog is due to the change of its owner. If I dismiss
this claim as a ridicuclous one he will accuse me of trolling and send you
an off-list complaint about me so that you turn up with a whip (or,
probably, even with a noose). Nothing particularly new here, don’t you
think…
Anton Bassov
NTDEV is sponsored by OSR
Visit the list online at:
http:
MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:
To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:>
> Actually, the OSR Bernese Mountain Dog is extremely friendly. Dogs rarely give you
ticks and parasites, trolls on the other hand do…
Well, Peter asked me to be more “creative”, right? Therefore, in order to comply with his request I decided to project your numerous libelous statements about the supposed bugs, lawsuits, damages and alleged theft (i.e. the things that you are so fond of speaking about) from the world of software titles to the canine one for the sole purpose of demonstrating how absurd these statements are and how “objective” their author is. Furthermore, for the reasons of clarity I decided to apply my natural sense of humour to the task, and presented things in an ironical way. What’s wrong with this???
Anton Bassov
You’re asking what’s wrong with what you’re doing here?
mm
On Feb 19, 2016 7:40 PM, wrote:
> > Actually, the OSR Bernese Mountain Dog is extremely friendly. Dogs
> rarely give you
> > ticks and parasites, trolls on the other hand do…
>
>
> Well, Peter asked me to be more “creative”, right? Therefore, in order to
> comply with his request I decided to project your numerous libelous
> statements about the supposed bugs, lawsuits, damages and alleged theft
> (i.e. the things that you are so fond of speaking about) from the world of
> software titles to the canine one for the sole purpose of demonstrating
> how absurd these statements are and how “objective” their author is.
> Furthermore, for the reasons of clarity I decided to apply my natural sense
> of humour to the task, and presented things in an ironical way. What’s
> wrong with this???
>
>
> Anton Bassov
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
></http:>