Hooking thread creation/termination

Question

Is it possible to hook into thread termination on Windows? IOW, I would like to be notified if a thread inside the process (not interested in other processes and their threads) has terminated (either normally or - more important - forcefully).

Alternatively, hooking into thread creation would also do.

Rationale: I have a library that manages some information on per-thread basis (think of it as a process-wide per-thread cache for some information). When a thread is terminated I have to remove all thread-specific information from the cache. [Cache associations are implemented using thread ID which may get reused for future threads.]

There's no problem with "normal" execution order as the library user will detach the current thread from the library which will clear the state. Problems start to appear if somebody kills the thread owning cached resource.

Answer 1

You could use something like Detours to do API-level hooking of Win32 APIs like TerminateThread.

I'm not seeing why you need to do this, though. It sounds like you need to clear the thread's associated cache when the thread dies so you can re-use that slot if another thread with the same ID comes along. Is this correct?

If so, couldn't you just clear the cache association in DllMain when you get the DLL_THREAD_ATTACH event? This is essentially your new thread notification. At this point, you know you have a new thread, so isn't it safe to clear the existing associated cache?

The other alternative that might work is thread-local storage (TLS). You can use Win32 APIs like TlsAlloc/TlsSetValue to store thread-specific information. You could also define a variable with __declspec(thread) to have the compiler manage the TLS for you. This way, each thread maintains its own cache. The code remains the same for each thread, but the data accesses are relative to the thread.

Answer 2

Chris' mention of DLL_THREAD_ATTACH gave me an idea ...

Basically, associating cache with thread ID is a bad thing. I have to rework my library so that a thread will initially establish some kind of handle and then manage associations using this handle.

Answer 3

Boost provides boost::this_thread::at_thread_exit() which allows you to provide arbitrary code to run when the current thread exits. If you call this on each thread then when it exits normally the code will be run. If a thread is terminated forcibly with TerminateThread then no more code is run on that thread, so the at_thread_exit functions are not called. The only way to handle such cases would be to hook TerminateThread, though this won't necessarily handle the case that another process terminates your threads.

Answer 4

The only way to reliably do this is in a DLL that hooks DLL_THREAD_ATTACH and DLL_THREAD_DETACH. See previous discussion here.