Home > Enterprise >  Where is a thread's context saved and can it be accessed programmatically (without modifying th
Where is a thread's context saved and can it be accessed programmatically (without modifying th

Time:10-28

Windows Context Switching

The scheduler maintains a queue of executable threads for each priority level. These are known as ready threads. When a processor becomes available, the system performs a context switch. The steps in a context switch are:

  • Save the context of the thread that just finished executing.
  • Place the thread that just finished executing at the end of the queue for its priority.
  • Find the highest priority queue that contains ready threads.
  • Remove the thread at the head of the queue, load its context, and execute it.

I don't know much about the topic yet, so I don't know how to elaborate on my question. Where is a thread's context saved, and can it be accessed (edit: read) programmatically (without modifying the kernel)?

CodePudding user response:

If you have a handle to a thread with the required access rights you can suspend the thread and then call GetThreadContext. When a thread is running the values are in the real CPU registers, when it is not running the context is stored in memory not accessible from usermode.

The context stores the values of various CPU registers, it is only useful to debuggers and advanced features like code injection and error logging.

  • Related