Where is threads window

In a multiprocessor system, the affinity mask determines which processors on which a thread can run. Suspended Count : An advanced column hidden by default that displays the suspended count. This count determines whether a thread can run. For more information about suspended counts, see Freeze and thaw threads. Process Name : An advanced column hidden by default that displays the process to which each thread belongs. The data in this column can be useful when you're debugging many processes.

Process ID : An advanced column hidden by default that displays the process ID to which each thread belongs. Transport Qualifier : An advanced column hidden by default that uniquely identifies the machine to which the debugger is connected. You can flag a thread that you want to give special attention by marking it with an icon in the Threads window.

For more information, see How to: Flag and Unflag threads. In the Threads window, you can choose to display all the threads or only the flagged threads. When you freeze a thread, the system won't start execution of the thread even if resources are available. In native code, you can suspend or resume threads by calling the Windows functions SuspendThread and ResumeThread. If you call SuspendThread or ResumeThread , the suspended count shown in the Threads window will be changed.

The suspended count doesn't change if you freeze or thaw a native thread. A thread can't execute in native code unless it's thawed and has a suspended count of zero.

In managed code, the suspended count changes when you freeze or thaw a thread. If you freeze a thread in managed code, its suspended count is 1. When you freeze a thread in native code, its suspended count is 0, unless you used the SuspendThread call.

When you debug a call from native code to managed code, the managed code runs in the same physical thread as the native code that called it. Suspending or freezing the native thread freezes the managed code also. A yellow arrow indicates the current thread and the location of the execution pointer. A green arrow with a curly tail indicates a non-current thread has the current debugger context. When you group threads, a heading appears in the table for each group. For threads created by the Windows CreateThread function, Process Explorer displays the function passed to CreateThread , not the actual thread start function.

If Process Explorer showed the actual start address, most threads in processes would appear to have started at the same address, which would not be helpful in trying to understand what code the thread was executing. However, the thread start address displayed might not be enough information to pinpoint what the thread is doing and which component within the process is responsible for the CPU consumed by the thread.

This is especially true if the thread start address is a generic startup function for example, if the function name does not indicate what the thread is actually doing. In this case, examining the thread stack might answer the question. To view the stack for a thread, double-click on the thread of interest or select it and click the Stack button. While the user-mode debuggers WinDbg, Ntsd, and Cdb permit you to attach to a process and display the user stack for a thread, Process Explorer shows both the user and kernel stack in one easy click of a button.

You can also examine user and kernel thread stacks using WinDbg in local kernel debugging mode. Viewing the thread stack can also help you determine why a process is hung. As an example, on one system, Microsoft Office PowerPoint was hanging for one minute on startup. To determine why it was hung, after starting PowerPoint, Process Explorer was used to examine the thread stack of the one thread in the process. The result is shown in Figure This thread stack shows that PowerPoint line 10 called a function in Mso.

So, without having to understand the internals of PowerPoint, the module and function names displayed on the thread stack indicate that the thread was waiting to connect to a network printer. On this particular system, there was a network printer that was not responding, which explained the delay starting PowerPoint. Microsoft Office applications connect to all configured printers at process startup. Finally, when looking at bit applications running on bit systems as a Wow64 process see Chapter 3 for more information on Wow64 , Process Explorer shows both the bit and bit stack for threads.

So, when examining Wow64 processes, be sure to take into account both the bit and bit stacks. The stack frames highlighted in the box are the bit stack frames from the bit stack. As we discussed in the process internals section, protected processes have several limitations in terms of which access rights will be granted, even to the users with the highest privileges on the system. These limitations also apply to threads inside such a process.

This ensures that the actual code running inside the protected process cannot be hijacked or otherwise affected through standard Windows functions, which require the access rights in Table Disables full access to a thread inside a protected process. You must be in a debugging session to open or see the Threads and other debugging windows.

The gutter next to the source code line now displays a thread marker icon. The thread marker indicates that a thread is stopped at this location.

If there is more than one stopped thread at the location, the icon appears. Hover the pointer over the thread marker. A DataTip appears, showing the name and thread ID number for the stopped thread or threads. To help identify nameless threads, you can rename them in the Threads window.

Right-click the thread and select Rename. Right-click the thread marker in the source code to see the available options on the shortcut menu. Flag and unflag threads from the source code editor or from the Threads window. Choose whether to display only flagged threads, or all threads, from the Debug Location or Threads window toolbars. Selections made from any location affect all locations.

You can also right-click in the toolbar area and select Debug Location. Drop down the Thread list, and note how many threads there are.

In the source code window, hover over a thread marker icon in the gutter and select the flag icon or one of the empty flag icons in the DataTip. The flag icon turns red. You can also right-click a thread marker icon, point to Flag , and then select a thread to flag from the shortcut menu. The icon is grayed out unless one or more threads are flagged. Only the flagged thread now appears in the Thread dropdown in the toolbar. To show all threads again, select the Show Only Flagged Threads icon again.

After you have flagged some threads, you can place your cursor in the code editor, right-click, and select Run Flagged Threads to Cursor. Make sure to choose code that all flagged threads will reach. Run Flagged Threads to Cursor will pause threads on the selected line of code, making it easier to control the order of execution by freezing and thawing threads.

To toggle the flagged or unflagged status of the currently executing thread, select the single flag Toggle Current Thread Flagged State toolbar button, to the left of the Show Only Flagged Threads button.

Flagging the current thread is useful for locating the current thread when only flagged threads are showing. To unflag a thread, hover over the thread marker in the source code and select the red flag icon to clear it, or right-click the thread marker and select Unflag. In the Threads window, flagged threads have red flag icons next to them, while unflagged threads, if shown, have empty icons.

Select a flag icon to change the thread state to flagged or unflagged, depending on its current state. You can also right-click a line and select Flag , Unflag , or Unflag All Threads from the shortcut menu.

The Threads window toolbar also has a Show Flagged Threads Only button, which is the right-hand one of the two flag icons. It works the same as the button on the Debug Location toolbar, and either button controls the display in both locations. In the Threads window, select the header of any column to sort the threads by that column.

Select again to reverse the sort order. If all threads are showing, selecting the flag icon column sorts the threads by flagged or unflagged status.