How to get the PID of the a thread's creator (not owner, not host)

Question

The THREADENTRY32 structure contains a member called th32OwnerProcessID, which is described as:

The identifier of the process that created the thread.

I'm not sure if I understand how the CreateRemoteThread function works. However, I would expect that the thread created by Process A via CreateRemoteThread, in the address space of Process B, would have the th32OwnerProcessID equal to the ID of Process A (if we were to take the description of the th32OwnerProcessID as quoted above). I was a bit surprised to see that it is actually equal to the ID of Process B.

Could someone please explain why this is so? And how to get the ID of the actual creator of the thread, i.e. Process A in my example?

Answer 1

That should really say "the identifier of the process that is hosting the thread", since that's what it is. The snapshot that is created by the Toolhelp APIs is system-wide, so in order to understand where a thread lives, you need its process ID. That would be meaningless if it said process A, if process A created a remote thread in process B and then exited. In that case, the PID belonging to process A at the time of creation might end up being reused by the next process that is created, and obviously be completely unrelated to the thread.

Consider this a different way: creating a remote thread is merely making a request to the remote process to create the thread, so the remote process is the one who creates thread. There is no concept of who made the request.