0

Hi I've looked around for an answer to this question and I am wondering if anyone with experience in windows internals knows if the kernel ever will assign a process id that is the same as a thread id. What I mean is say there is process a.exe that I have started that has a thread with id 123. If another process is started, for example b.exe, will the process id be 123? In other words do process and thread identifiers ever collide? Thanks

EDIT: It appears that process and thread ids come from the same pool called the PspCidTable. A hacker named Polynomial who reviewed the windows nt source says the following:

The kernel needs to be able to generate a sequence of process and thread IDs that are unique across the whole system. To efficiently and safely do this, the kernel creates a pool of IDs that can be used for both processes and threads. This pool is exported in the kernel as a HANDLE_TABLE object called PspCidTable. During Phase0 startup of the system, the PspInitPhase0 function is called. This function creates a HANDLE_TABLE object using ExCreateHandleTable, which automatically populates the table with 65536 entires. Each entry is a 16-bit unsigned integer (at least it is on a 32-bit OS) stored inside a list item object that is part of a doubly linked list. Both process and thread IDs come from the PspCidTable pool.

Source for above: Stuff you (probably) didn't know about Windows

The PspCidTable still exists in Windows XP and empirical observations in Windows 7 lead me to believe the above is still true.

loop
  • 3,460
  • 5
  • 34
  • 57
  • 4
    It would probably be best to assume that they can, which is safe, rather than assuming that they can't, which may cause issues later – Hasturkun Oct 11 '11 at 19:05
  • I agree but I was wondering if there is any definitive answer. – loop Oct 11 '11 at 19:11
  • 2
    How PID/TIDs are assigned is always an implementation detail and should never be relied upon. – Cat Plus Plus Oct 11 '11 at 19:11
  • I don't see a reason the generation of the two should be coupled together - if so, it would be far simpler to generate both independently (i.e. allow collisions). –  Oct 11 '11 at 19:13
  • I had noticed that some of the processes on my system have a pid that is four less than a thread id in the process. So what I mean is the pid is 460 and the thread ids are 464 and 468. So I was thinking maybe windows is taking into account the pid before assigning tids, regardless of the process. – loop Oct 11 '11 at 19:19

1 Answers1

3

Thread and process ids come from the same pool in all versions of windows AFAIK but that does not mean that this will be true forever. In practice it should not matter at all since you should only pass things that you know is thread id to OpenThread and vice versa.

Don't assume other things about these ids either (They are not 16 bit, they might seem like they are on NT but it is possible to get ids > 0xffff (On Win9x they are xor'ed with a secret and often use the full 32 bits))

The only weird thing you should keep in the back of your mind is that on 64 bit systems they are 32 bit in user mode and pointer sized in kernel mode (Use HandleToUlong/UlongToHandle)

Anders
  • 97,548
  • 12
  • 110
  • 164
  • Thanks for your reply. Do you remember the source that says they come from the same pool or can you explain how you know this or where you heard it? Thanks – loop Oct 11 '11 at 19:26
  • nevermind I googled for source and added the answer to my question. I have marked your answer as correct, thanks for your answer and advice about the ids. – loop Oct 11 '11 at 20:00
  • @test: I probably got my information from a windows internals book but http://en.wikipedia.org/wiki/Process_identifier also says they are shared. You can see the ReactOS usage of PspCidTable @ http://doxygen.reactos.org/df/d84/psmgr_8c_source.html#l00049 – Anders Oct 11 '11 at 21:43