4 ms·
I'm confused by this post, but I'm an ex-dev on the NT kernel. ResumeThread is a well documented API. As is TerminateJobObject. The one thing I find a bit baro
by neerajsi 7y ago
I'm confused by this post, but I'm an ex-dev on the NT kernel.
ResumeThread is a well documented API. As is TerminateJobObject. The one thing I find a bit baroque is the recently added way to make sure a process is in a job on creation, which I believe is part is the ProcThreadAttributes mechanism.
- jchw 7y agoYes, ResumeThread is. NtResumeProcess is what I had to use, because Go immediately closes the thread handle. I’m sure it’s safe to rely on NtResumeProcess. I have used it since XP without issue. But I definitely wish there was a better way to go back from a process to a thread. The best I could find is using Toolhelp32 to iterate all the threads on the system, which I believe is just wrapping NtQuerySystemInformation. Would’ve worked but definitely wasn’t fast.