OVALProject/Sandbox — Issue #7: add support for collecting thread information in windows processes
Author: djhaynes
Created: 2012-03-05 14:08:14+00:00
State: open

We should add support for the collection of thread information that is associated with processes in windows.

Threads may be queried via process handles. A thread test in windows could leverage the process58_object to find a process ID and then look up threads associated with the process id.

Need to be able to query:

- Creation Time - See GetThreadTimes (http://msdn.microsoft.com/en-us/library/ms683237(v=VS.85).aspx) use the
lpCreationTime value

- Entry Point - See ZwQueryInformationThread (http://msdn.microsoft.com/en-us/library/ms687420(v=VS.85).aspx)

- Running Status - Uncertain what this value should be based upon.

One challenge is that thread id are not static. We will need to find a way to differentiate one thread from another.

Please see slide 10 of the slides attached to the following oval-developer-list post.

http://making-security-measurable.1364806.n2.nabble.com/Developer-Days-Artifact-Hunting-Slides-tp6463048p6463048.html