1

The THREADENTRY32 structure contains a member called th32OwnerProcessID, which is described as:

The identifier of the process that created the thread.

I'm not sure if I understand how the CreateRemoteThread function works. However, I would expect that the thread created by Process A via CreateRemoteThread, in the address space of Process B, would have the th32OwnerProcessID equal to the ID of Process A (if we were to take the description of the th32OwnerProcessID as quoted above). I was a bit surprised to see that it is actually equal to the ID of Process B.

Could someone please explain why this is so? And how to get the ID of the actual creator of the thread, i.e. Process A in my example?

3

That should really say "the identifier of the process that is hosting the thread", since that's what it is. The snapshot that is created by the Toolhelp APIs is system-wide, so in order to understand where a thread lives, you need its process ID. That would be meaningless if it said process A, if process A created a remote thread in process B and then exited. In that case, the PID belonging to process A at the time of creation might end up being reused by the next process that is created, and obviously be completely unrelated to the thread.

Consider this a different way: creating a remote thread is merely making a request to the remote process to create the thread, so the remote process is the one who creates thread. There is no concept of who made the request.

  • I totally agree that the description of th32OwnerProcessID should actually be "the identifier of the process that is hosting the thread" as you said Peter Ferrie. However, I'm really interested if it is possible to get the ID of a threads' creator and how to do it. – Benny Feb 1 '14 at 14:04
  • @Benny, I just edited my answer to resolve your query - there isn't a way to do that. – peter ferrie Feb 3 '14 at 19:26
  • OK Peter, since I haven't been able to find a solution for my question either, I'll mark your answer as the solution. Thanks! – Benny Feb 3 '14 at 19:37
  • does your answer also imply that a thread created via CreateRemoteThread by a Medium integrity process, inside the address space of a Low integrity process, will be a Low integrity thread? – Benny Feb 5 '14 at 14:55
  • I haven't checked, but that should be so, otherwise it creates an elevation of privileges condition, if the low integrity process takes control of the medium integrity thread. – peter ferrie Feb 7 '14 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.