How can i get the thread ID in the PsSetCreateProcessNotifyRoutine callback in windows?

user_7225528 0
Viewed 135

I am using the older version for process creation callback (PsSetCreateProcessNotifyRoutine) to support older systems.

My question is, what is the easiest way inside my callback function to obtain the main thread ID of the process?

wdk kernel c windows
1 Answers

You can use PsLookupProcessByProcessId to get the EPROCESS from a process by passing in its process id. You can get the ThreadListHead from the EPROCESS structure wich is a linked list. The linked list contains entrys of the ETHREAD structure of each thread. In this structure you can find the CreateTime. You can then compare every threads CreateTime and then wich one was created the earliest is the main thread.

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-pslookupprocessbyprocessid

https://www.nirsoft.net/kernel_struct/vista/EPROCESS.html

https://www.nirsoft.net/kernel_struct/vista/ETHREAD.html

user_111617310
Related