Search code examples
winapimfcwmi

Documentation for ThreadWaitReason

I am searching the documentation for ThreadWaitReason 1..31. Especially I am interested for 

ThreadWaitReason = 27 
ThreadWaitReason = 31

I have found is [1]: https://msdn.microsoft.com/en-us/library/aa394494(v=vs.85).aspx but it's only listed until 1..20.

Solution

  • KWAIT_REASON enum is declared in wdm.h - you can view different values from it ( 27 is WrResource and 31 is WrDispatchInt).

    the thread object (KTHREAD) itself have WaitReason field. and every time, before thread became wait (not active) system write to this field some reason value. when we, in kernel, direct call KeWaitForSingleObject or KeWaitForMultipleObjects we by self set the WaitReason value. when we call another function, which can cause wait - system yourself set WaitReason. for example if call KeDelayExecutionThread (kernel mode implementation of Sleep[Ex] ) system set WaitReason to WrDelayExecution. when we call resource function ( ExAcquireResourceExclusiveLite for example) - system set WaitReason to WrResource (27) . when system swap thread, because it quantum expired - system set WaitReason to WrDispatchInt (31). and so on.

    when we call NtQuerySystemInformation with SystemProcessInformation - system read value from WaitReason and return it in SYSTEM_THREAD_INFORMATION structure.

    obviously the WaitReason have sense primary when thread is waiting - so it state is Waiting (5) . otherwise we got old value - reason why thread wait last time