How to list threads in WinDbg (kernel debugging)
Solution 1
~
only works in user mode. To list all threads on the system, it's !process 0 1
as I recall (it's been awhile).
"Specifically I am looking to the find the ID of a thread that caused an event, namely a breakpoint."
This statement doesn't make much sense to do from kernel mode. Can you descrive more about what your scenario is?
Edit: Ah, now I get it. You want to know which thread you're currently in right now. Give !thread
a go.
Solution 2
You can always use the @$thread pseudo register to reference the current thread object:
0: kd> r @$thread
$thread=fffff80002c02cc0
If you want the ID of the thread, you'll need to dig it out of the ETHREAD. Luckily, the @$thread is typed as a pointer to an ETHREAD if you're using the C++ evaluator:
0: kd> ?? @$thread->Cid
struct _CLIENT_ID
+0x000 UniqueProcess : 0x00000000`00001408 Void
+0x008 UniqueThread : 0x00000000`0000144c Void
-scott
user963228
Updated on July 28, 2022Comments
-
user963228 almost 2 years
Does anyone know how I can list all threads in WinDbg while kernel debugging. I have found older references that say '~' but that does not work.
Specifically I am looking to the find the ID of a thread that caused an event, namely a breakpoint.
Thanks.
-
user963228 over 12 yearsYeh, I have a breakpoint on NtLoadDriver, just would like to know the ID of the thread that raises the exception.
-
cwhisperer over 12 yearsHow are you setting the breakpoint? You can't set or intercept breakpoints on user-mode code by default while in a kernel debugger.
-
user963228 over 12 yearsI mean NtLoadDriver in ntoskrnl, so the thread is already executing in supervisor mode (ring 0). With debug symbols I just type kd> bp NtLoadDriver
-
user963228 over 12 yearsand it breaks fine as expected when I expect it too. Im just looking for a way to retrieve the ID of the thread that is raising the exception.
-
Isaac about 10 yearsFor the record, it should be !process 0 2 to show threads for each process. If you also want a stack trace, you can use !process 0 6. This gets extremely verbose though, so I'd recommend providing a specific process to look at instead of using 0.