3 ms·
Both the loader and thread management are part of the OS. It's an implementation detail, but I'd expect CreateThread to do it - perhaps by delegating to the loa
by barrkel 7y ago
Both the loader and thread management are part of the OS. It's an implementation detail, but I'd expect CreateThread to do it - perhaps by delegating to the loader, perhaps by navigating the loader's list of loaded modules, whatever.
See these pages:
https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createthread https://docs.microsoft.com/en-us/windows/win32/api/processth...
https://docs.microsoft.com/en-us/windows/win32/dlls/dllmain https://docs.microsoft.com/en-us/windows/win32/dlls/dllmain
- mehrdadn 7y agoThe thing about CreateThread doing it is that then a thread created in a different matter (CreateRemoteThread from another process, RtlCreateUserThread, etc.) would cause a missed notification. I feel like it has to be the entrypoint, but not sure...
- barrkel 7y agoSure, but when I say CreateThread I mean the implementation of CreateThread, not the function CreateThread. (This feels like a weird autistic conversation, I'm going to step out now.)