Thread Events

Thread events notify the creation or termination of threads within the process address space via CreateThread and TerminateThread events respectively. When the thread object is acquired, the OpenThread event is fired. Processes can manipulate thread context of local or remote threads. Under this circumstances the SetThreadContext is triggered. The following sections summarize all the distinct event parameters that are associated with thread events captured by Fibratus

CreateThread

PARAMETER DESCRIPTION
pid Process identifier where the thread has been spawned. If this value is not equal to the pid of the process generating the event, then the thread is created in the virtual address space of another process using the CreateRemoteThread API function.
tid Represents the identifier of the freshly spawn thread.
base_prio Scheduler priority for the new thread.
page_prio Memory page priority hint for memory pages accessed by the thread.
io_prio I/O priority hint for scheduling I/O operations generated by the thread.
ustack_base Base address of the thread's user space stack.
ustack_limit Limit of the thread's user space stack.
kstack_base Base address of the thread's kernel space stack.
kstack_limit Limit of the thread's kernel space stack.
start_address Start address of the function to be executed by the thread.
start_address_symbol Symbol the represents the thread start address, for example, LoadLibraryEx
start_address_module Module that maps to the thread start address, for example, ntdll.dll
teb Address of the TEB (Thread Environment Block) structure that describes the state of a thread.

TerminateThread

PARAMETER DESCRIPTION
pid Process identifier where the thread has been terminated.
tid Represents the identifier of the terminated thread.
base_prio Scheduler priority of the thread.
page_prio Memory page priority hint for memory pages accessed by the thread.
io_prio I/O priority hint for scheduling I/O operations generated by the thread.
ustack_base Base address of the thread's user space stack.
ustack_limit Limit of the thread's user space stack.
kstack_base Base address of the thread's kernel space stack.
kstack_limit Limit of the thread's kernel space stack.
start_address Start address of the function thread used to execute.
teb Address of the TEB (Thread Environment Block) structure that describes the state of a thread.

OpenThread

PARAMETER DESCRIPTION
desired_access Value that represents the desired access to the thread object.
desired_access_names List of human-readable desired access strings, for example, QUERY_LIMITED_INFORMATION. For a full list and detailed explanation of available access rights, head to the official docs.
name Name of the local process whose thread object was open.
exe Full path of the local process image whose thread object was open.
pid Identifier of the local process whose thread object was opened.
tid Identifier of the local thread that was opened.
status System status of the thread object open operation, for example, Success

SetThreadContext

PARAMETER DESCRIPTION
status System status of the thread context set operation, for example, Access denied

Thread pool events

A thread pool is a collection of worker threads that efficiently execute asynchronous callbacks on behalf of the application. The thread pool is primarily used to reduce the number of application threads and provide management of the worker threads. Fibratus collects the following thread pool telemetry.

SubmitThreadpoolWork SubmitThreadpoolCallback

SubmitThreadpoolWork enqueues the work item to the thread pool. SubmitThreadpoolCallback submits the thread pool callback for execution within the work item. These events has the following parameters:

PARAMETER DESCRIPTION
pool_id Represents the thread pool identifier.
task_id Represents the thread pool task identifier.
callback Represents the address of the callback function
context Represents the address of the callback context.
subprocess_tag Represents the service identifier associated with the thread pool.
callback_symbol Represents the callback symbol, for example, RtlCaputreContext
callback_module Represents the module containing the callback symbol, for example, C:\Windows\System32\ntdll.dll
context_rip Represents the value of instruction pointer contained in the callback context
context_rip_symbol Represents the symbol name associated with the instruction pointer in callback context.
context_rip_module Represents the module name associated with the instruction pointer in callback context.

SetThreadpoolTimer

Sets the thread pool timer object. This event consists of the following parameters:

PARAMETER DESCRIPTION
duetime Represents the timer due time.
subqueue Represents the memory address of the timer subqueue.
timer Represents the memory address of the timer object.
period Represents the period of the timer.
window Represents the timer tolerate period.
absolute Indicates if the timer is absolute or relative.