NtAlertResumeThread - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTPSAPI_H
//
// Threads
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* Resumes a thread that was previously suspended and sends an alert to it.
*
* \param ThreadHandle A handle to the thread to be resumed and alerted.
* \param PreviousSuspendCount An optional pointer to a variable that receives the thread's previous suspend count.
* \return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAlertResumeThread(
_In_ HANDLE ThreadHandle,
_Out_opt_ PULONG PreviousSuspendCount
);
View code on GitHub#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAlertResumeThread(
_In_ HANDLE ThreadHandle,
_Out_opt_ PULONG PreviousSuspendCount
);
View code on GitHubAlerts and resumes the specified thread that previously entered an alertable wait and then was suspended. Once the suspension counter drops to zero, the thread wakes and returns STATUS_ALERTED.
ThreadHandle - a handle to a thread granting THREAD_SUSPEND_RESUME access.PreviousSuspendCount - an optional pointer to a variable that receives the previous value of the suspension counter of the thread.Despite the name similarity, this function is unrelated to NtAlertThreadByThreadId.
This functionality is not exposed in Win32 API.
Handle to thread object.
Returns number of suspend request for thread ThreadHandle before call NtAlertResumeThread. If this number is 0,
thread will continue execution.
Difference between AlertResumeThread and ResumeThread it's the first one sets Thread Object to alerted state (so before thread will continue execution, all APC will be executed).