How to retrieve the primary thread of the process?
Hello!
My simple question is:
Is there any way to retrieve the primary thread handle of the current process from outside of this thread?
Thanks in advance!
[182 byte] By [
Yofi] at [2007-11-20 1:38:32]

# 1 Re: How to retrieve the primary thread of the process?
Is there any way to retrieve the primary thread handle of the current process from outside of this thread?When you create a process via CreateProcess(), the PROCESS_INFORMATION structure that it fills in will also contain the handle and ID of the process' primary thread - is that what you were asking for?
# 2 Re: How to retrieve the primary thread of the process?
Yes!
I mean, inside some other threads in the process, how can I retrieve the handle to the primary thread?
Yofi at 2007-11-10 23:18:48 >

# 3 Re: How to retrieve the primary thread of the process?
I mean, inside some other threads in the process, how can I retrieve the handle to the primary thread?The simplest way would be to call GetCurrentThread (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/getcurrentthread.asp) when inside the main thread at process start time, and cache that HANDLE in a variable (that is reachable from other threads that wish to use the same).
# 4 Re: How to retrieve the primary thread of the process?
The simplest way would be to call GetCurrentThread (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/getcurrentthread.asp) when inside the main thread at process start time, and cache that HANDLE in a variable (that is reachable from other threads that wish to use the same).Good approach, Sid - but with a catch: Note that GetCurrentThread() returns a pseudo-handle - it is valid only within the context of the calling thread. You need to additionally use DuplicateHandle() to convert it into a real thread handle, which can then be used from within other threads and processes.
# 5 Re: How to retrieve the primary thread of the process?
Thank you for adding that note, Guido... :)
Yes, the catches are precisely why I supplied a link to the documentation...
The function cannot be used by one thread to create a handle that can be used by other threads to refer to the first thread. The handle is always interpreted as referring to the thread that is using it. A thread can create a "real" handle to itself that can be used by other threads, or inherited by other processes, by specifying the pseudo handle as the source handle in a call to the DuplicateHandle function.:D
# 6 Re: How to retrieve the primary thread of the process?
This solution does'nt solve my problem...
In my case, the primary thread starts suspended and I want the other thread to resume it.
The primary thread has no chance to store its handle...
Is it possible to retrieve the handle directly?
Yofi at 2007-11-10 23:22:51 >

# 7 Re: How to retrieve the primary thread of the process?
I dont get it if the primary thread start suspended how do other threads get created? or who creates them?
# 8 Re: How to retrieve the primary thread of the process?
In my case, the primary thread starts suspended and I want the other thread to resume it.Hm... Just wondering: If the primary thread starts suspended - who the heck is creating the additional threads? :confused:
# 9 Re: How to retrieve the primary thread of the process?
Well... Evidently, GetCurrentThread needs to be called before the other threads are created...
EDIT: Cool... Two people posted a blink before I did... :D
# 10 Re: How to retrieve the primary thread of the process?
Two people posted the same post at the same time...
And for you two:
Ever heard about CreateRemoteThread??!!
Yofi at 2007-11-10 23:26:57 >

# 11 Re: How to retrieve the primary thread of the process?
Ever heard about CreateRemoteThread??!!Huh? So you mean, what you do here is: Process A creates process B in suspended state Process A calls CreateRemoteThread() to start additional threads in Process B, which then resume the primary thread of Process B?
# 12 Re: How to retrieve the primary thread of the process?
Exactly! That's the case!
Yofi at 2007-11-10 23:28:54 >

# 13 Re: How to retrieve the primary thread of the process?
Exactly! That's the case!You should have specified this earlier. Anyways, activating threads when the main thread is suspended doesnt seem to be a good implementation - at first glance.
It looks like you use CreateRemoteThread to control the sequence of thread-activity execution in the launched process. I would recommend an implementation where the launched process was launched in a normal state (i.e. with the main thread non-suspended) wherein it caches the main-thread's handle using GetCurrentThread and waits on a signal from the calling process to perform thread-activity i.e. uses inter-process synchronization. This wait can be implemented using a WaitForSingleObject (http://windowssdk.msdn.microsoft.com/en-gb/library/ms687032.aspx) on Named Events / Mutexes.
If you wish to stick to the current approach, the threads created remotely can be supplied with the main-thread's handle (or ID) as a parameter in your call to CreateRemoteThread.
# 14 Re: How to retrieve the primary thread of the process?
Exactly! That's the case!In addition to what Sid said: If that's the case, then where's the problem of retrieving the handle of process B's primary thread from the PROCESS_INFORMATION structure after creating the the process (in step 1 above)?
# 15 Re: How to retrieve the primary thread of the process?
I found out again, how a simple task can become a huge headache...
None of your ideas can help in my case.
I can't change the primary thread. It is a black-box for me. I do not have the source of that process.
I can't pass the handle from PROCESS_INFORMATION structure to the other process from the same reason.
I just need to retrieve it direcrly from the process, and it seems to be impossible. It seems so stupid to me!
Thank you anyway!
Yofi at 2007-11-10 23:31:59 >

# 16 Re: How to retrieve the primary thread of the process?
I found out again, how a simple task can become a huge headache...Well, this is actually not a simple task - but looks like a strangely contrieved situation...
I can't change the primary thread. It is a black-box for me. I do not have the source of that process.Hm... So, in this case, how would you expect the additional threads that you are creating in that foreign, unknown process space to communicate with the process' primary thread in any meaningful way?
Perhaps you can explain better what exactly you are trying to do here, and why?
# 17 Re: How to retrieve the primary thread of the process?
I found out again, how a simple task can become a huge headache...
None of your ideas can help in my case.Doesn't his looks like a text-book case of how poor poor implementation keeps a developer from using the many simple solutions available (that have been presented in this thread) and want to seek something a lot more complicated.
Really, you should be talking this issue out to the developer of that "black box" - for one, he could not use CreateRemoteThread on an application developed by you without your co-operation (with thread function names, et al).[in] Pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. For more information on the thread function, see ThreadProc.
# 18 Re: How to retrieve the primary thread of the process?
Hm... So, in this case, how would you expect the additional threads that you are creating in that foreign, unknown process space to communicate with the process' primary thread in any meaningful way?
I do not have to communicate with the process' primary thread at all!
I just want it to resume during my additional thread!
Yofi at 2007-11-10 23:35:06 >

# 19 Re: How to retrieve the primary thread of the process?
I do not have to communicate with the process' primary thread at all!
I just want it to resume during my additional thread!Hm... Your setup remains strange, however. I mean, what's the purpose of that "black box" application if it is created in suspended state and waits for injected threads to wake it up?
Anyways, if you just want to resume a process that you created in suspended mode, you don't need CreateRemoteThread() at all, but can do so using the ToolHelp API: Use CreateToolhelp32Snapshot() with TH32CS_SNAPTHREAD to create a snapshot of all threads. Then use Thread32First() / Thred32Next() to walk the thread list, and test the th32OwnerProcessID field of the THREADENTRY32 structure until you find the ID of your "blackbox" process. You can then open the associated thread via OpenThread(), and resume it via ResumeThread().
# 20 Re: How to retrieve the primary thread of the process?
I do not have to communicate with the process' primary thread at all!
I just want it to resume during my additional thread!
There is no good way to get main thread from inside of process considering your case. There are two ways you can solve this,
1. Supply the main thread ID to remote thread and then do resume it from the remote thread.
2. Inside the process (call it process A) where you called CreateRemoteThread, wait for some event which will be signaled by that remote thread once you need to resume main thread and then call ResumeThread from process A.
# 21 Re: How to retrieve the primary thread of the process?
There is no good way to get main thread from inside of process
This is the only determind and useful conclusion that actualy answer my question...
Thank you.
Yofi at 2007-11-10 23:38:13 >

# 22 Re: How to retrieve the primary thread of the process?
This is the only determind and useful conclusion that actualy answer my question...Well... Note that there is a way, of course: The approach using the ToolHelp API will work as well from within a thread of the same process. It's just that, according to how you described your problem, it would be pointeless to do it that way, since resuming the thread from within your calling process (as described above) would be much easier than injecting a thread via CreateRemoteThread().
# 23 Re: How to retrieve the primary thread of the process?
I repeat: There is no good way to do it.
Resuming the thread from within the calling process is not always possible, because sometimes the calling process might be shut down before the second process should resume... (Guess what - this is my case ;))
Also using ToolHelp API is not the ultimate solution. How should I know which thread is the primary thread? Besides it is not optimal to do that much work for this task.
I tend to consider this as a system lack in API support.
Yofi at 2007-11-10 23:40:07 >

# 24 Re: How to retrieve the primary thread of the process?
I tend to consider this as a system lack in API support.
Why not try the 2nd aproach of resuming the thread from the parent process ?
# 25 Re: How to retrieve the primary thread of the process?
Supply the main thread ID to remote thread and then do resume it from the remote thread.
This sounds good and logical.
# 26 Re: How to retrieve the primary thread of the process?
Yes indeed why not use lpParameter to pass the thread handle to ur remote thread routine?
kolkoo at 2007-11-10 23:43:13 >

# 27 Re: How to retrieve the primary thread of the process?
Yes indeed why not use lpParameter to pass the thread handle to ur remote thread routine?The handle holds meaning only in the context of current thread which actually got it (createthread, createprocess, getwindow...). so, you cannot pass it to the remote thread. But you can pass the threadid to the remotethread. in remote thread call openthread to get a handle to the thread.
# 28 Re: How to retrieve the primary thread of the process?
I see that I didn't clear myself enough.
Sorry for that.
I can't describe the whole parts of my project so I'll try to clear the point:
1. Process A creates process B, which is a complete black-box.
2. Process A injects a thread into process B using CreateRemoteThread.
3. That thread run under process B, and it want the handle of the primary thread of this process.
Is this an exaggerated request?
Suggestions so far:
1. The primary thread store its handle - impossible (black-box).
2. Supply it as a parameter in the call to CreateRemoteThread - This parameter is preserved and processes by foreign code expecting a hard-coded syntax.
3. Using ToolHelp API to find the thread - There is no way to differentiate a primary thread and a regular thread.
4. Send a signal to the calling process which handle that thread - Bad strategy. And if the calling process should shut down?
Another option: pass it using a shared memory. (Looks difficult to me :()
O.K. but I still keep thinking that this is a great lack in API service. Isn't it?
Yofi at 2007-11-10 23:45:19 >

# 29 Re: How to retrieve the primary thread of the process?
3. That thread run under process B, and it want the handle of the primary thread of this process.Question: What do you wish to do with this HANDLE of a thread that is not running?
BTW...O.K. but I still keep thinking that this is a great lack in API service. Isn't it?It certainly isn't a "great lack".
In fact, many may argue that the unnecessary flexibility that the system has supplied in terms of "CreateRemoteThread" has resulted in this situation, and an absence of this API would have resulted in a better implementation on your end, resulting in no need to get that HANDLE from any external thread.
# 30 Re: How to retrieve the primary thread of the process?
Do not pass the handle to the remote thread. instead pass the thread id and do a openthread in the remotethread. Is it that bad?
In fact, many may argue that the unnecessary flexibility that the system has supplied in terms of "CreateRemoteThread" has resulted in this situation, and an absence of this API would have resulted in a better implementation on your end, resulting in no need to get that HANDLE from any external thread.Yes, I think we are using the api rather it is not meant to be.
# 31 Re: How to retrieve the primary thread of the process?
Referencing Richter (http://www.wintellect.com/TechnicalBioDetail.aspx?Tech=3) (Programming Applications for Microsoft Windows, Fourth Edition (http://www.amazon.com/Programming-Applications-Microsoft-Windows-General/dp/1572319968/sr=8-1/qid=115929710)) and Russinovich (http://blogs.technet.com/markrussinovich/) / Solomon (http://www.solsem.com/) (Windows Internals, Fourth Edition (http://www.amazon.com/Microsoft-Windows-Internals-Fourth-Pro-Developer/dp/0735619174/ref=pd_sim_b_1/102-252))...
The first thread in a process starts its user-mode life in kernel32!BaseProcessStart, while additional threads begin in kernel32!BaseThreadStart.
Walk the thread's stack and figure out where it came from, and you can determine if the thread is the "primary" thread.