Home/ Questions/Q 1070419
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T20:33:52+00:00

As you can see above , there are 4 win32 threads at exactly the

  • 0

alt text

As you can see above , there are 4 win32 threads at exactly the same location, how to understand it?
UPDATE

7C92E4BE  mov         dword ptr [esp],eax 
7C92E4C1  mov         dword ptr [esp+4],0 
7C92E4C9  mov         dword ptr [esp+8],0 
7C92E4D1  mov         dword ptr [esp+10h],0 
7C92E4D9  push        esp  
7C92E4DA  call        7C92E508 
7C92E4DF  mov         eax,dword ptr [esp] 
7C92E4E2  mov         esp,ebp 
7C92E4E4  pop         ebp  
7C92E4E5  ret              
7C92E4E6  lea         esp,[esp] 
7C92E4ED  lea         ecx,[ecx] 
7C92E4F0  mov         edx,esp 
7C92E4F2  sysenter         
7C92E4F4  ret
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The debugger shows the next ring3 processor instruction that is going to be executed. In this case the thread has called sysenter, which makes a ring0 system call to the operating system’s kernel. This kernel system call is waiting for something to happen before returning control back to the calling code. Once that something happens, then it will call the next user-mode instruction, which in this case is ret.

    If you have 4 threads that are all calling the same function that waits for a system call at the same location, you will have 4 threads that show the same address in the Threads window. This is something that you will see quite often in applications built with the Windows subsystem, which usually have a number of threads that are started by the Windows API that spend most of their time waiting for kernel events.

    • 0