How can I list threads that are active in system?

NTDEV
1

Hi All,

Please tell me, how can I list out the threads that are on shadular list and in sleep state?

Thanks & Regards,
Amit.

2

u can use *Win32_PerfFormattedData_PerfProc_Thread* of Performance Counter
Classes through WMI

On 4/30/07, xxxxx@yahoo.com
wrote:
>
> Hi All,
>
> Please tell me, how can I list out the threads that are on shadular list
> and in sleep state?
>
> Thanks & Regards,
> Amit.
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

3

Niraj Jha wrote:

u can use *Win32_PerfFormattedData_PerfProc_Thread* of Performance
Counter
Classes through WMI

On 4/30/07, xxxxx@yahoo.com
> wrote:
>>
>> Hi All,
>>
>> Please tell me, how can I list out the threads that are on shadular list
>> and in sleep state?
>>

WMI And Performance Counter Information about fundamental system objects
such as threads, processes and files is a bunch of slow, weird
wrappers around more sensible lower level APIs (usually documented)
which return that information in a more useful form.

To get information about threads without the WMI->PerfCtr->API detour,
look at any of the following APIs:

- ZwQuerySystemInformation (undocumented, changes with Windows version).
- Tool Helper 32 API (Documented kernel32.dll functions, not in NT 4.0,
user mode only).
- PSAPI.DLL (Old redistributable DLL for NT 4.0 and older, may be
included in Windows 2000 or later, user mode only).
- OpenThread/ZwOpenThread and
GetThreadInformation/ZwQueryThreadInformation (mix of documented and
undocumented APIs, maybe you only need documented ones).
- Thread commands in WinDbg / KD (Available during debugging only).

–
Jakob B?hm, M.Sc.Eng. * xxxxx@danware.dk * direct tel:+45-45-90-25-33
Danware Data A/S * Bregnerodvej 127 * DK-3460 Birkerod * DENMARK
http://www.netop.com * tel:+45-45-90-25-25 * fax tel:+45-45-90-25-26
Information in this mail is hasty, not binding and may not be right

4

> how can I list out the threads that are on shadular list and in sleep state?

Impossible task…

The only thing you can find out is what the scheduler’s list *WAS* like at the time when it was examined - if you are interested in that, ZwQuerySystemInformation() call with infoclass 5 is going to return the sought info. However, keep in mind that the list changes transparently to your driver/app, and, hence, it may look already differently by the time ZwQuerySystemInformation() rerurns control, i.e. you may get outdated info. This is particularly true for SMP machines…

Anton Bassov