Question

Is it possible to hook into thread termination on Windows? IOW, I would like to be notified if a thread inside the process (not interested in other processes and their threads) has terminated (either normally or – more important – forcefully).

Alternatively, hooking into thread creation would also do.

Rationale: I have a library that manages some information on per-thread basis (think of it as a process-wide per-thread cache for some information). When a thread is terminated I have to remove all thread-specific information from the cache. [Cache associations are implemented using thread ID which may get reused for future threads.]

There’s no problem with “normal” execution order as the library user will detach the current thread from the library which will clear the state. Problems start to appear if somebody kills the thread owning cached resource.

Answer 1

You could use something like Detours to do API-level hooking of Win32 APIs like TerminateThread.

I’m not seeing why you need to do this, though. It sounds like you need to clear the thread’s associated cache when the thread dies so you can re-use that slot if another thread with the same ID comes along. Is this correct?

If so, couldn’t you just clear the cache association in DllMain when you get the DLL_THREAD_ATTACH event? This is essentially your new thread notification. At this point, you know you have a new thread, so isn’t it safe to clear the existing associated cache?

The other alternative that might work is thread-local storage (TLS). You can use Win32 APIs like TlsAlloc/TlsSetValue to store thread-specific information. You could also define a variable with __declspec(thread) to have the compiler manage the TLS for you. This way, each thread maintains its own cache. The code remains the same for each thread, but the data accesses are relative to the thread.