Function GetMainThreadId

WSASS.cpp:136–180

Get main thread ID of a process using NtQuerySystemInformation

}
// Get main thread ID of a process using NtQuerySystemInformation
DWORD GetMainThreadId(DWORD pid)
{
    ULONG bufferSize = 0x10000;
    PVOID buffer = nullptr;
    NTSTATUS status;
    PNtQuerySystemInformation NtQuerySystemInformation =
        (PNtQuerySystemInformation)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtQuerySystemInformation");

    do {
        buffer = VirtualAlloc(nullptr, bufferSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
        if (!buffer) return 0;

        status = NtQuerySystemInformation(SystemProcessInformation, buffer, bufferSize, nullptr);
        if (status == STATUS_INFO_LENGTH_MISMATCH) {
            VirtualFree(buffer, 0, MEM_RELEASE);
            bufferSize *= 2;
        }
    } while (status == STATUS_INFO_LENGTH_MISMATCH);

    if (!NT_SUCCESS(status)) {
        VirtualFree(buffer, 0, MEM_RELEASE);
        return 0;
    }

    DWORD mainThreadId = 0;
    LARGE_INTEGER earliestCreateTime = { 0x7FFFFFFFFFFFFFFF };
    auto spi = (MY_SYSTEM_PROCESS_INFORMATION*)buffer;

    while (true) {
        if ((DWORD)(ULONG_PTR)spi->UniqueProcessId == pid) 
        {
            if (spi->NumberOfThreads > 0)
            {
                mainThreadId = (DWORD)(ULONG_PTR)spi->Threads[0].ClientId.UniqueThread;
            }
            break;
        }

        if (spi->NextEntryOffset == 0) break;
        spi = (MY_SYSTEM_PROCESS_INFORMATION*)((BYTE*)spi + spi->NextEntryOffset);
    }

    VirtualFree(buffer, 0, MEM_RELEASE);
    return mainThreadId;
}

void ResumeProcessLoop(DWORD pid) 
{