kernel objects question ( NtQuerySystemInformation)

Hi,

Anyone knows if a kernel object "thread" obtained with NtQuerySystemInformation is it possible to find out who have created that object in memory

or lets say, is it possible within a certain process lets say cmd.exe all the "thread" objects listed to identify which was not created by the process cmd.exe ??

Note: I'm looking into identify an object that was created by a foreign process into the current process. Also I'm trying to understand if objects like "Event" "Mutex" activity increases in the event of an foreign process changes the normal behavior of a certain process .

Thanks in advance
Regards

Quote:

---

Originally Posted by norox

Hi,

Anyone knows if a kernel object "thread" obtained with NtQuerySystemInformation is it possible to find out who have created that object in memory

or lets say, is it possible within a certain process lets say cmd.exe all the "thread" objects listed to identify which was not created by the process cmd.exe ??

Note: I'm looking into identify an object that was created by a foreign process into the current process. Also I'm trying to understand if objects like "Event" "Mutex" activity increases in the event of an foreign process changes the normal behavior of a certain process .

Thanks in advance
Regards

---

Possibly use the KTHREAD structure to trace back to the EPROCESS structure to determine which process owns the thread in question. Here is a link that provides detailed info on thread internals.

thanks BobS

you help me before with kernel objects :)

I'm going to have look into that. even if doesn't say which process is the owner if I can find information saying that the "thread" is not from the orginal process is saying is from someone else :)

btw do you know if this would be still valid in Vista ?