Thread context for PsSetCreateThreadNotifyRoutine's callback?

NTDEV
1

DDK/MSDN documentation claims that a thread creation callback registered by
PsSetCreateThreadNotifyRoutine() is called in the context of the newly
created thread. My tests show that the callback is done in the context of the
parent thread: PsGetCurrentThread() called from the callback returns ETHREAD
of the parent.

Am I doing something wrong or is DDK incorrect here?

Dmitriy Budko
VMware

2

My tests give the same results as yours. The creation callback is in the
context of the creating process and thread.

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]
On Behalf Of Dmitriy Budko
Sent: Friday, January 11, 2008 7:39 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Thread context for PsSetCreateThreadNotifyRoutine’s
callback?

DDK/MSDN documentation claims that a thread creation callback registered by
PsSetCreateThreadNotifyRoutine() is called in the context of the newly
created thread. My tests show that the callback is done in the context of
the parent thread: PsGetCurrentThread() called from the callback returns
ETHREAD of the parent.

Am I doing something wrong or is DDK incorrect here?

Dmitriy Budko
VMware

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Dmitry,

IIRC, DDK documentation *was* saying that a callback gets invoked in context of either a creating or a system thread. However, WDK, indeed, says that a callback gets invoked in context of a newly-created thread. Therefore, we have 2 possibilities:

  1. The way callbacks are invoked are different for Vista and earlier OS version

  2. MSDN introduced yet another bug in the documentation

Anton Bassov

4

Be weary of the docs, In playing around I saw callbacks come-in in the
context of other threads. This
has been reported in other threads, I suggest you search the archives more.
Perhaps I and others were
doing something wrong,

I don’t totally trust the docs on this function… Then again, it was in
my first few drivers that I saw this,
there is a high probability I was doing something wrong, but then again,
getting a function like this wrong
is kinda hard to do.

All I’m saying is do a bit of testing before relying upon the context of the
callback routine.

Good Luck and Regards,

Matt

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Saturday, January 12, 2008 4:59 AM
Subject: RE:[ntdev] Thread context for PsSetCreateThreadNotifyRoutine’s
callback?

> Dmitry,
>
> IIRC, DDK documentation was saying that a callback gets invoked in
> context of either a creating or a system thread. However, WDK, indeed,
> says that a callback gets invoked in context of a newly-created thread.
> Therefore, we have 2 possibilities:
>
> 1. The way callbacks are invoked are different for Vista and earlier OS
> version
>
> 2. MSDN introduced yet another bug in the documentation
>
>
> Anton Bassov
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>