I wrote a little program which just shows a dialog. Basically an ASM Hello World. When the dialog is displayed and I break in WinDBG, I can see three threads even though the application doesn't use any threads at all.
I was not aware that there is something like default threads applied to a process, or is this because of WinDBG?
The Process/Thread window shows
000:13d4:MyApp.exe 000:d14 001:11bc 002:50c
If I put a memory access breakpoint and the process would have multiple threads, do I have to specify in which thread this should be triggered. I think this shouldn't matter right? So if an address is accessed by any thread, the breakpoint should trigger regardless.
So I took now a closer look (the handle numbers have changed, but the IDs are relevant anyway). I'm Running Windows 7-32bit-x86 if that helps.
000: refers to my original process, but this was already known.
001: Stacktrace when I break looks like this (some thread snychronization required by WinDBG?):
ntdll!KiFastSystemCallRet kernel32!WaitForMultipleObjectsEx+0x8e kernel32!WaitForMultipleObjects+0x18 msiltcfg!RestartMsi+0x32e kernel32!BaseThreadInitThunk+0x12 ntdll!RtlInitializeExceptionChain+0xef ntdll!RtlInitializeExceptionChain+0xc2
It seems that this thread belongs to some
msiltcfg.dll which would be a Windows 7 DLL, but why does it cread threads in my process?
002: So this would probably be the WinDBG thread which Akira32 refers to in his answer, right? (why does WinDBG need a thread of his own?).
ntdll!DbgBreakPoint kernel32!BaseThreadInitThunk+0x12 ntdll!RtlInitializeExceptionChain+0xef ntdll!RtlInitializeExceptionChain+0xc2