Inside the thread kernel object, there is a value used to indicate the thread's suspension count. When the CreateProcess or createthread function is called, the kernel object of the thread is created and its suspension count is initialized to 1. This prevents threads from being scheduled to the CPU. The reason is that it takes time to initialize the thread and you want to execute the thread after the system is fully prepared.
After the thread is fully initialized, run CreateProcess or createthread to check whether the crecreate _ suincluded flag has been passed. If this flag has been passed, these functions are returned and the new thread is suspended. If this flag has not been passed, the function will decrease the thread's pause count to 0. When the pause count of a thread is 0, the thread is in the schedulable State unless the thread is waiting for something else to happen.
Create a suspended thread to change the running environment (such as priority) of the thread before the thread has the opportunity to execute any code ). Once the thread environment is changed, the thread must become a schedulable thread. To perform this operation, you can call resum ETHREAD to pass the thread handle returned when the createthread function is called to it (or pass the thread handle pointed to by the ppiprocinfo parameter passed to createproce ss to it ):
DWORDResumeThread(Handlehthread );
If the resum ETHREAD function runs successfully, it returns the previous suspension count of the thread; otherwise, 0 xffffffff is returned.
A single thread can be paused several times. If a thread is paused three times, it must be restored three times before it can be allocated to a CPU. When creating a thread, you can also call the suspendthread function to suspend the thread running in addition to create_suincluded:
DWORDSuspendThread(Handlehthread );
Any thread can call this function to pause the running of another thread (as long as it has a thread handle ). The thread can pause the operation on its own, but cannot resume the operation on its own. Note: The execution of suspendthread and kernel mode is asynchronous, but the user mode is not executed until the thread resumes running.
Note: In the actual environment, you must be careful when calling SuspendThread, because you do not know what operations it is performing when the suspended thread is running. If a thread tries to allocate memory from the stack, the thread will set a lock on the stack. When other threads attempt to access the stack, the access to these threads is stopped until the first thread resumes running. Only by knowing exactly what the target thread is (or what the target thread is doing), and taking strong measures to avoid problems or deadlocks caused by the running of the suspended thread, suspendThread is safe. (FangSH Note: you must know what the thread to be suspended is doing. Otherwise, it may cause deadlocks or other problems)
FangSH 2010-12-28