Uninformed: Informative Information for the Uninformed

Vol 4» 2006.Jun

Thread Objects

Here is a brief list of things to check when scanning for ETHREAD objects.

  • Compare against a high level API such as kernel32!CreateToolhelp32Snapshot.
  • Compare against a system call such as nt!NtQuerySystemInformation.
  • Does the process have a valid owning process?
  • Can PsLookupThreadByThreadId open its Cid.UniqueThread?
  • What does Win32StartAddress point to? Is it a valid module address?
  • What is its ServiceTable value?
  • If it is in a wait state, for how long?
  • Where is its stack? What does its stack trace look like?