4

I've been using code that I found in the following post:

How to get thread state (e.g. suspended), memory + CPU usage, start time, priority, etc

I'm examining thread state, and there's the following enum that describes the reasons for thread 'waiting' status -

enum KWAIT_REASON
{
    Executive,
    FreePage,
    PageIn,
    PoolAllocation,
    DelayExecution,
    Suspended,
    UserRequest,
    WrExecutive,
    WrFreePage,
    WrPageIn,
    WrPoolAllocation,
    WrDelayExecution,
    WrSuspended,
    WrUserRequest,
    WrEventPair,
    WrQueue,
    WrLpcReceive,
    WrLpcReply,
    WrVirtualMemory,
    WrPageOut,
    WrRendezvous,
    Spare2,
    Spare3,
    Spare4,
    Spare5,
    Spare6,
    WrKernel,
    MaximumWaitReason
};

Can anyone explain what WrQueue is, and perhaps what the difference between WrUserRequest and UserRequest is?

The information is obtained using NtQuerySystemInformation() with SystemProcessInformation.

3
  • SystemProcessInformation does not return any thread wait reason information. Dec 28, 2017 at 14:42
  • 1
    @IInspectable In the code from that post I see that it returns array of SYSTEM_PROCESS, which holds SYSTEM_THREAD array for each one of the processes. SYSTEM_THREAD holds the wait reason
    – Roy Rashti
    Dec 28, 2017 at 14:46
  • @IInspectable - you mistake. SystemProcessInformation return array of SYSTEM_PROCESS_INFORMATION which containing array of SYSTEM_[EXTENDED_]THREAD_INFORMATION and here exist member KWAIT_REASON WaitReason;
    – RbMm
    Dec 28, 2017 at 14:47

1 Answer 1

7

WrQueue this is when thread waits on KQUEUE object (look it definition in wdm.h) in kernel. this can be call to ZwRemoveIoCompletion or Win32 shell GetQueuedCompletionStatus (IOCP is exactly KQUEUE object). or thread (begining from vista) call ZwWaitForWorkViaWorkerFactory (worker factory internally use KQUEUE. also possible that thread in kernel calls KeRemoveQueue - this usually does system working threads.

WrUserRequest is used by win32k.sys subsystem. Usually this is when thread calls GetMessage. So if we view WrUserRequest we can be sure that thread is waiting for window messages.

UserRequest - this means that thread waits on some object[s] via WaitForSingleObject[Ex] or WaitForMultipleObjects[Ex] or MsgWaitForMultipleObjects[Ex] (or it equivalents)

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.