When using PsSetCreateThreadNotifyRoutine to be informed of a Thread
creation there is a problem:
if you try to use PsLookThreadByThreadId or even if your try to open the
thread by ID you get an error:
‘invalid parameter’ in the former case and ‘invalid client ID’ in the later
case.
The error happens because there is field to zero on the thread object (an
undocumented field).
Actually the thread object is created and there is a space allocated for it.
The field I need is there and has a valid value but I cannot get the pointer
because the field mentioned above is zero.
Actually the function PsLookThreadByThreadId do get the ponter but returns
an error.
Even,the function that calls the target for PsSetCreateThreadNotifyRoutine
gets the pointer prior to calling the target!
However, it does not deliver the pointer but the ID.
I wonder why Windows notifies about one thread being created while it is not
yet complete.
The question would be: is it possible to get the thread object pointer from
the thread ID without using any of these functions ?
I know there is one, but it is not exported (ExGetPointerFromHandle).