Posted on 2013-03-14 10:38
宋鹏 阅读(1097)
评论(1) 编辑 收藏 引用
在一个线程出现异常行为时,比如说CPU占用率过高,抛出异常等,你一定想知道这个线程是由哪个模块创建的。因此无论在哪个操作系统上,获取线程名称是诊断线程相关问题的重要一步。
从线程ID获取线程名称通常的方法是,先获取该线程的入口地址,然后枚举进程内所有已加载模块,最后判断线程入口地址落在哪个加载模块范围内。枚举进程内已加载模块可用Win32标准的CreateToolhelp32Snapshot/Module32First/Module32Next系列ToolHelp API得到。获取线程入口地址则没有线程的Win32 API可用。不过在Windows NT based操作系统上(包括Windows NT 4.0/2000/XP/2003,等),有一个未公开的Native API可用:NtQueryInformationThread。其声明如下:
DWORD WINAPI NtQueryInformationThread(
HANDLE ThreadHandle,
THREAD_INFORMATION_CLASS ThreadInformationClass,
PVOID ThreadInformation,
ULONG ThreadInformationLength,
PULONG ReturnLength
);
获取线程入口地址可用:
DWORD GetThreadStartAddress(DWORD dwThreadId)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
...{
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, dwThreadId);
DWORD retaddr, len, error;
retaddr = len = 0;
error = NtQueryInformationThread( hThread, 9, &retaddr, sizeof(retaddr), &len );
CloseHandle(hThread);
if( error != 0 )
retaddr = 0;
return retaddr;
} 在Windows CE上就没这么幸运了,没有任何现成的API可用。官方Windows CE Base Team的
blog对
这个问题的回答是可以用Remote Kernel Tracker,不过这需要你build一个特殊的kernel image,enable一些profiler功能-这在显示的问题诊断中显然是不实际的。那么有没有办法不需要什么特殊的配置就可像Windows桌面操作系统那样获得入口地址呢?有是有的,不过需要一些hack手段。仔细研究CE下的Thread内核数据结构,就会发现Thread结构中有一项是记录线程入口地址的。
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
typedef struct Thread ...{
DWORD _1[3];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
PPROCESS pProc; /**//* 0C: pointer to current process */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
PPROCESS pOwnerProc; /**//* 10: pointer to owner process */
DWORD _2[18];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
DWORD dwStartAddr; /**//* 5c: thread PC at creation, used to get thread name */
DWORD _3[10];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
}THREAD, *PTHREAD; /**//* Thread */
因此要做的就是想办法根据线程ID或handle得到这个数据。再研究,发现线程的Thread内核数据结构可通过句柄得到:
PTHREAD pTh = HandleToThread(ThreadHandle); 而且,在Windows CE下,线程ID和其handle的值是一样的!!因此我们可以写一个这样的函数从线程ID拿到入口地址:
DWORD GetThreadStartAddress(DWORD dwThreadId)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
...{
DWORD dwStartAddress = 0;
BOOL fOldMode = SetKMode(TRUE);
PTHREAD pTh = HandleToThread((HANDLE)dwThreadId);
if (pTh)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
...{
dwStartAddress = (DWORD)MapPtrToProcess((LPVOID)pTh->dwStartAddr, pTh->pOwnerProc->hProc);
}
return dwStartAddress;
} 为了使用这些内核数据结构,我们还需要另外一些辅助结构和函数,比较完整的代码如下。当然,官方肯定是不建议这么做的,但是重要的是解决问题,你说呢。
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
typedef struct Process ...{
DWORD _1[2];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
HANDLE hProc; /**//* 08: handle for this process, needed only for SC_GetProcFromPtr */
}PROCESS, *PPROCESS;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
typedef struct Thread ...{
DWORD _1[3];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
PPROCESS pProc; /**//* 0C: pointer to current process */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
PPROCESS pOwnerProc; /**//* 10: pointer to owner process */
DWORD _2[18];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
DWORD dwStartAddr; /**//* 5c: thread PC at creation, used to get thread name */
DWORD _3[10];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
}THREAD, *PTHREAD; /**//* Thread */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
typedef struct cinfo ...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
char acName[4]; /**//* 00: object type ID string */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
uchar disp; /**//* 04: type of dispatch */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
uchar type; /**//* 05: api handle type */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
ushort cMethods; /**//* 06: # of methods in dispatch table */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
const PFNVOID *ppfnMethods;/**//* 08: ptr to array of methods (in server address space) */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
const DWORD *pdwSig; /**//* 0C: ptr to array of method signatures */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
PPROCESS pServer; /**//* 10: ptr to server process */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
} CINFO; /**//* cinfo */
typedef CINFO *PCINFO;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
typedef struct _HDATA HDATA, *PHDATA;
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
struct _HDATA ...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
DWORD _1[2]; /**//* 00: links for active handle list */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
HANDLE hValue; /**//* 08: Current value of handle (nonce) */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
DWORD lock; /**//* 0C: access information */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
DWORD ref; /**//* 10: reference information */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
const CINFO *pci; /**//* 14: ptr to object class description structure */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
PVOID pvObj; /**//* 18: ptr to object */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
DWORD dwInfo; /**//* 1C: extra handle info */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
}; /**//* 20: sizeof(HDATA) */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
#ifdef x86
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
struct KDataStruct ...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
LPDWORD lpvTls; /**//* 0x000 Current thread local storage pointer */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
HANDLE ahSys[NUM_SYS_HANDLES]; /**//* 0x004 If this moves, change kapi.h */
DWORD _1[4];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
ulong handleBase; /**//* 0x094 base address of handle table */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
}; /**//* KDataStruct */
#endif
#ifdef ARM
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
struct KDataStruct ...{
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
LPDWORD lpvTls; /**//* 0x000 Current thread local storage pointer */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
HANDLE ahSys[NUM_SYS_HANDLES]; /**//* 0x004 If this moves, change kapi.h */
DWORD _1[6];
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
ulong handleBase; /**//* 0x09c handle table base address */
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
}; /**//* KDataStruct */
#endif
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
#define HandleToThread(h) ((THREAD *)GetObjectPtrByType((h),SH_CURTHREAD))
#define HANDLE_ADDRESS_MASK 0x1ffffffc
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
void h2p(HANDLE h, PHDATA& phdRet)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
...{
if ((ulong)h < NUM_SYS_HANDLES+SYS_HANDLE_BASE && (ulong)h >= SYS_HANDLE_BASE)
h = ((KDataStruct*)PUserKData)->ahSys[(uint)h-SYS_HANDLE_BASE];
if (h)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
...{
phdRet = (PHDATA)(((ulong)h & HANDLE_ADDRESS_MASK) + ((KDataStruct*)PUserKData)->handleBase);
if (phdRet->hValue != h)
phdRet = 0;
}
else
phdRet = 0;
}
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
PVOID GetObjectPtrByType(HANDLE h, int type)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
...{
PHDATA phd;
h2p(h, phd);
return (phd && phd->pci && phd->pci->type==type) ? phd->pvObj : 0;
}
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
extern "C" LPVOID WINAPI MapPtrToProcess(LPVOID lpv, HANDLE hProc);
extern "C" BOOL WINAPI SetKMode(BOOL fMode);
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/None.gif)
DWORD GetThreadStartAddress(DWORD dwThreadId)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedBlockStart.gif)
...{
DWORD dwStartAddress = 0;
BOOL fOldMode = SetKMode(TRUE);
PTHREAD pTh = HandleToThread((HANDLE)dwThreadId);
if (pTh)
![](http://images.csdn.net/syntaxhighlighting/OutliningIndicators/ExpandedSubBlockStart.gif)
...{
dwStartAddress = (DWORD)MapPtrToProcess((LPVOID)pTh->dwStartAddr, pTh->pOwnerProc->hProc);
}
return dwStartAddress;
}