I've been using code that I found in the following post:
How to get thread state (e.g. suspended), memory + CPU usage, start time, priority, etc
I'm examining thread state, and there's the following enum that describes the reasons for thread 'waiting' status -
enum KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel,
MaximumWaitReason
};
Can anyone explain what WrQueue
is, and perhaps what the difference between WrUserRequest
and UserRequest
is?
The information is obtained using NtQuerySystemInformation()
with SystemProcessInformation
.
SystemProcessInformation
does not return any thread wait reason information.SystemProcessInformation
return array ofSYSTEM_PROCESS_INFORMATION
which containing array ofSYSTEM_[EXTENDED_]THREAD_INFORMATION
and here exist memberKWAIT_REASON WaitReason;