Search code examples
c++windowswinapirustwmi

How to query a running thread for its parameters list? (Windows, Rust/C++)

This is in continuation of How to query a running process for its parameters list? (Windows, C++).

I am currently using WMI to get the arguments a process was launched with, but WMI does not contain the same information for a thread.

For a given Windows thread, I want to know what parameters it was started with.

Solution

  • You can't.

    The CreateThread function allows a client to pass a single value. Its interpretation is at the discretion of the thread routine. The only requirement being that the value is pointer-sized. No other assumptions about its type are being made, so even if you somehow managed to get a hold of the value, you wouldn't know how to interpret it.

    This is in contrast to the command line arguments passed into a process, that differ in two significant ways:

    • They have a well-known type, so anyone knows how to interpret them.
    • They are stored by the OS in a special place, so anyone can get access at any time.

    The latter, in particular, isn't true for a thread's argument(s): The caller of CreateThread and the thread routine privately coordinate how long the value needs to live. And when that time is over, the value is gone, forever.