Check if a Win32 thread is running or in a suspended state

Question

How do I check to see if a Win32 thread is running or in suspended state?

I can\'t find any Win32 API which gives the state of a thread. So how do I get the thread s

Answer 1

You can get this information by calling NtQuerySystemInformation() with the value for SystemProcessesAndThreadsInformation (integer value 5).

If you want an example of what you can do with this information take a look at Thread Status Monitor.

Answer 2

In Windows 7, you can use QueryUmsThreadInformation. (UMS stands for User mode scheduling).

See here for UmsThreadIsSuspended.

Answer 3

WMI's Win32_Thread class has a ThreadState property, where 5: "Suspended Blocked" and 6:Suspended Ready.

You will need the Thread's Id to get the right instance directly (the WMI object's Handle property is the thread id).

EDIT: Given this PowerShell query:

gwmi win32_thread | group ThreadState

gives

Count Name  Group
----- ----  -----
    6 2     {, , , ...}
  966 5     {, , , ...}

WMI has a different definition of "Suspended" to Win32.

Answer 4

I think - originally - this information was not provided because any API that provided this info would be misleading and useless.

Consider two possible cases - the current thread has suspended the thread-of-interest. Code in the current thread knows about the suspended state and should be able to share it so theres no need for the kernel team to add an API.

The 2nd case, some other / a 3rd thread in the system has suspended the thread of interest (and theres no way to track which thread that was). Now you have a race condition - that other thread could, at any time - unsuspend the thread of interest and the information gleaned from the API is useless - you have a value indicating the thread is suspended when it is in fact, not.

Moral of the story - if you want to know that a thread is suspended - suspend it: The return value from SuspendThread is the previous suspend count of the thread. And now you DO know something useful - The thread WAS AND STILL IS suspended - which is useful. Or that it WASN't (but now is) suspended. Either way, the thread's state is now deterministically known so you can in theory make some intelligent choices based on that - whether to ResumeThread, or keep it suspended.

Answer 5

I think the state here is referred to as

• If thread is in thread proc , doing some processing Or
• Waiting for event

This can be taken care of by using variable which can tell that if a thread is actually running or waiting for event to happen.

These scenarios appear when considering threadpools, having some n threads and based on each thread running status , tasks can be assigned to idle threads.

Answer 6

you could get thread suspend count with code like this:

DWORD GetThreadSuspendCount(HANDLE hThread) {
    DWORD dwSuspendCount = SuspendThread(hThread);
    ResumeThread(hThread);
    return dwSuspendCount;
}

but, as already said - it is not accurate. Moreover, suspending a thread is evil.