Undependable thread

[zfz]

I have been searching around and can not really figure out how to make a thread "unterminable" and "interminable."

I am guessing I have to fill the structure LPSECURITY_ATTRIBUTES (specifically lpSecurityDescriptor), but I am not sure with what... any suggestions?

[Ajay Vijay]

You mean the thread or the whole process which cannot be terminated?

[zfz]

Just the actual thread... let me give an example


unsigned long __stdcall Thread( void* pVoid )
{
while( 1 )
{
printf( "Hi!\n" );
Sleep( 2000 );
}

return 0;
};

CreateThread( 0, 0, Thread, 0, 0, 0 );


If I run this, and open, say ProcessExplorer and try to suspend this thread; it will work fine and stop the printf. I want to fill in the first parameter (I think!) of CreateThread, so if I try to suspend the thread in ProcessExplorer or a similar program, it will give me whatever error message it gives when it can not suspend the thread successfully. I am guessing this is possible because I reviewed the SuspendThread entry at MSDN and it states, "The handle must have the THREAD_SUSPEND_RESUME access right."

[Ajay Vijay]

May be this article would help:
http://www.codeguru.com/cpp/w-p/system/security/article.php/c10299/

[MikeAThon]

It's doubtful that you can prevent your thread from being suspended. I know it's not the same thing, but in the context of the TerminateThread function, the dcoumentation tells us this:
A thread cannot protect itself against TerminateThread, other than by controlling access to its handles. The thread handle returned by the CreateThread and CreateProcess functions has THREAD_TERMINATE access, so any caller holding one of these handles can terminate your thread.
If a thread can't prevent itslef from being terminated, I think it's unlikely that it can somehow prevent itself from being suspended.

Mike

[Ajay Vijay]

It's only applicable if you have the thread handle via CreateThread/CreateProcess, and not when you OpenThread or OpenProcess. If thread, process or any kernel object is protected using ACLs, it cannot be opened with THREAD_SUSPEND_RESUME rights.