Hey guys.

I am currently coding a process manager in delphi, I am researching way in which i can get the state of an application. I have experimented with NTQuerySystemInformation and found i can list process with and get there thread states which i have currently done however. how can i determining which thread is the main(parent) thread for that process.

example

-------->Thread #2

|

(thread 0) Notepad.exe ----> Thread #1

in this stupid example thread 0 is the main application, then i could return the state of this to display to my end user. is this possible? i saw a "hack" so to speak or an ugly way of getting a application state by calling ResumeThread() Followed by SuspendThread() and returning the Thread Counter from either API if counter is 0 thread is running else suspened.

so the main question is can i get the main or parent thread of a process to query for the overall application state.

thanks

{Doesnt matter what programming langauge}

You can use CreateToolhelp32Snapshot to obtain the thread information for the process, the first thread retrieved from the function is the main thread of the process (from what I recall when I learned about the API). So you can do something such as:

(I wrote this real quick in Notepad so it may have some mistakes you need to fix up real quick.)

DWORD GetMainThreadId( DWORD dwProcessId )
{
	THREADENTRY32 te32 = { sizeof( THREADENTRY32 ) };
	HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, dwProcessId );	if( hSnapshot == INVALID_HANDLE_VALUE )
		return NULL;	if( Thread32First( hSnapshot, &te32 ) )
	{
		do {
			if( te32.th32OwnerProcessID == dwProcessId )
			{
				CloseHandle( hSnapshot );
				return te32.th32ThreadID;
			}
		} while( Thread32Next( hSnapThreads, &te32 ) );
	}	CloseHandle( hSnapshot );
	return NULL;
}

Thank you for your reply, you confirmed what i suspected then that the first thread is the main thread, i was under the conclusion that the thread would be ordered randomly depending on when the api's where called. So know now that when i call NTQuerySystemInformation the structure has thread array so [0] in the array must be the application thread. I have read the thread wait and state from this article http://technet.micro...28WS.10%29.aspx from this my application lists the threads as per screenshot.

need to resolve file paths now so it works on x64bit an x32

Edited March 24, 201015 yr by StreamLine