监视线程创建

Question

I've been working on a driver for versions of Windows starting from Windows XP. for this, I'm using the routine PsSetCreateThreadNotifyRoutine. In the registered callback, I'm trying to access the context of threads and I'm not getting. I found the information that when the callback function is called, the threads are not still in the context that will be used.

I wonder if there is a function like kewaitforsingleobject that will signal when those threads get context?

I tried creating a new thread for each thread that arise and making them wait but do not think it is the best solution.

in this case, what is the best way to wait for the threads receive their contexts?

Answer 1

due to MSDN :

The driver's thread-notify routine runs at IRQL = PASSIVE_LEVEL. When a thread is created, the thread-notify routine runs in the context of the thread that created the new thread. When a thread is deleted, the thread-notify routine runs in the context of this thread when the thread exits.

so you have access to the parent thread's context when the new thread is created. I'm not sure, but it seems that you also have access to the deleting thread's context on it's deletion. (or maybe the parent again)

so, you can use a list for storing the Thread-IDs and have a worker thread to check each TID. don't forget about mutual exclusion. you can use a MUTEX or a SPINLOCK (don't know their actual name in the WDK).