.thread_id
global variable or not. If it is stored, then it's the thread that we want to see its results, and if not, there is no interest for interception. At last, we set the .thread_id
to 0
to indicate that we finish investigating this thread..thread_id
variable. .thread_id
to a Thread Id. As we're not configuring the SYSRET event yet, the thread might finish its execution (run SYSRET) before configuring the SYSCALL event, and thus, it never works properly.c:\users\sina\desktop\script.ds
.