Does anyone know if it's really not possible to get hold of an ID or handle to an arbitrary thread in a running process by way of "normal" win32 API commands (i.e. without using the ToolHelp or PSAPI libraries)?

When you create a process with CreateProcess, you are handed 4 numbers, the ID and handle of the process itself and the ID and handle of the main thread of the process, but when you attach to a running process with OpenProcess, you only get the ID and handle of the process itself, no thread info (which is of course quite understandable, since no thread can be considered "more main" than another in a process once it is running).

But the problem is that I cannot find any combination of "normal" win32 API commands for enumerating threads of a running process or in any other way getting hold of an arbitrary thread of a running process.

So, does anybody know for sure if this is impossible or not?

I don't really have high hopes about it after looking around on the net, but it seems like such a missing piece of the native debug API to me, that's all.

Thanks.
dELTA

why not disassemble the toolhelp functions and see what api they use?

Why do you want to avoid ToolHelp32 APIs?CreateToolhelp32Snapshot works admirably... Also, to get hold of a thread in arbitrary process... use OpenThread() API.

... trivial unless I'm missing something here...

Signed,
-- FoxThree

The OpenThread API does not work on Windows 9x (ok, it works on ME, but who cares).

The ToolHelp functions only work on Windows 9x.

Disassembling the ToolHelp functions, I'm sure its code would boild down to parsing some 9x-dependent undocumented system structures.


The reason I wanted to do it with the "genuine" Win32API was to make it platform independent, which none of the above is.

Thanks for the tips anyway guys! Sadly, I've already considered and rejected them all before though.

dELTA

so what if you can't figure out the structures? find what api functions are being called, and the work from there.

Toolhelp is included in Win9X, Win2K and above. SO unless you plan on developing for NT4 (which is a waste of time) you can use the toolhelp functions just fine.

As a guess, Toolhelp no doubt calls NtQuerySystemInformation for what it wants.


-nt20

You should checkout the latest proggie from none other than our friend EliCZ... EliRT ...

You would be amazed how this guy does all this

Signed,
-- FoxThree